Credentials

View as Markdown

Keep model API keys and tool credentials in the Worker's environment or in a secret store that the Worker reads when a call runs. Each framework reads its model key from the environment, such as OPENAI_API_KEY, GOOGLE_API_KEY, or ANTHROPIC_API_KEY. The adapters add no credential handling.

Never pass a credential in the session's start input, a user message, a tool argument, a tool output, or an Attribute. Dex stores all of them in Flow history and state:

Dex Web shows them.
History keeps superseded values for time travel.
A stopped session stays readable for the retention period.
Any authorized Client can read AgentEvents.

Session settings are part of the start input and of the session's state. get_agent_snapshot and the browser snapshot JSON return them. So session settings hold only references that the Worker resolves, such as a model name or a credential name.

A Connector tool stores only the logical connection name with the call, as a Connector Step does. The credentials stay with the Worker. See Connections.

For a credential that belongs to one user, let the tool look it up at call time from a secret store, with a key that is not the secret itself. When a Flow of your own must hold a short-lived secret, store it in a hard-delete Attribute and delete it when the Flow no longer needs it.

Workers and Clients authenticate to Dex Server with bearer credentials. See authentication.