Give every AI agent its own identity, issue short-lived tokens scoped to one job, and keep long-lived API keys out of prompts, repositories and shared environment files. Static keys leak and live too long. A short lease, an audience bound token and a log of every use limit the damage when something does go wrong.
Why are static keys a bad fit for agents?
An agent runs unattended, calls many tools, and reads text from untrusted places. A key sitting in its environment can be copied into a log, a prompt, a tool call or a chat transcript. Once copied, it works for as long as nobody revokes it.
OWASP's secrets management cheat sheet states the principle directly. Use dynamic secrets with short lease durations and revoke them when no longer needed. It adds that restarting an application does not itself revoke stolen credentials. It also advises rotating static secrets automatically so stolen credentials have a short useful life.
What does a better design look like?
Three ideas carry most of the weight.
1. Short-lived credentials by default. GitHub's documentation on OpenID Connect describes the pattern for pipelines. Instead of copying cloud credentials into long-lived secrets, you set up a trust relationship, and each run requests a short-lived token valid for a single job. The same shape works for agents: the agent proves who it is, and receives a token that expires.
2. Tokens bound to one audience. The Model Context Protocol authorization specification shows how tool access can be done properly. Clients use OAuth 2.1 with PKCE, include a resource parameter naming the server, and servers must validate that a token was issued specifically for them. Servers must not accept or pass through tokens meant for other services. The spec also says authorization servers should issue short-lived access tokens, and that tokens must not travel in the URL query string. For local transports it says to take credentials from the environment instead, which is a reminder that the environment is then the place to protect.
3. Least privilege per agent. OWASP's cheat sheet advises scoping CI/CD credentials to only the secrets a job needs, avoiding one big secret with a wide blast radius, and using separate vaults per application and environment.
What do you log?
OWASP recommends recording who requested a secret, whether it was approved, when it was used or updated, expiry events, reuse of expired secrets, authentication failures and administrative actions, with tamper protection. It also suggests alerting when a secret is used from an unexpected IP address or user agent and assuming compromise in that case.
What is the checklist?
- Inventory. List every agent and every credential it holds. Note the owner, where it is stored and when it expires.
- One identity per agent. No shared service accounts across agents or environments.
- Replace static keys with token exchange. Prefer OAuth flows or workload identity. Where you cannot, store the key in a secrets manager and let the agent fetch it at start, not in a file in the repo.
- Shorten lifetimes. Aim for minutes or hours for access tokens, and automate rotation for what must remain static.
- Bind to audience. Reject tokens at your servers that were not issued for them.
- Scope to the task. Read only where reading is enough. Separate keys for production and test.
- Keep secrets out of text the model sees. Prompts, tool outputs and logs travel widely.
- Scan for leaks. Check repositories, configuration files and agent settings for committed keys.
- Alert on odd use. New IP, new region, unusual volume. Assume compromise and revoke.
- Practice revocation. Time how long it takes to kill an agent's access. Fix the slow steps.
Where Safeguard fits
Secrets scanning looks for committed credentials, including in agent configuration files. The Safeguard MCP server at mcp.safeguard.sh gives tool access for Claude, ChatGPT, Cursor or your own agent, and tenant admins can switch off any client type. Try the guardrail demo to see how tool access can be controlled.
Quick check
Is a secrets manager enough?
It is a start. OWASP also recommends short leases, scoped access and auditing, so a manager that hands out a never expiring key to every agent solves little.
What should I do first?
Make the inventory of agents and credentials. You cannot shorten or scope keys you have not listed.
Sources
- OWASP, Secrets Management Cheat Sheet
- GitHub Docs, About security hardening with OpenID Connect
- Model Context Protocol, Authorization specification (2025-06-18)
Last reviewed: 18 October 2026.
