What is credential brokering for AI agents?

Credential brokering means the agent never holds the real secret. The agent proves its identity or sends a request with a placeholder, and a broker outside the model's reach checks policy and either issues a short-lived credential or injects the real credential into the outbound request. A prompt injection can then misuse the agent's access for the length of a session, but it cannot steal a long-lived key.

Is a secrets manager enough for AI agents?

No. A secrets manager stores and rotates credentials, but it usually hands the secret to the application — and for an agent the application includes a model that reads untrusted text. Keep the secrets manager as the vault, and add a broker so the credential is attached at the network boundary or minted per task instead of placed in the agent's environment.

Is 1Password Credential Broker available?

1Password announced Credential Broker on June 15, 2026 as a private beta, with general availability targeted for late 2026. It authenticates workloads such as GitHub Actions jobs or any system that issues an OIDC token and delivers only the credentials policy allows, with every delivery logged.

Quick Answer

Best Tools for Brokering Secrets to AI Agents at Runtime

Q: What are the best tools for brokering secrets to AI agents at runtime?

As of October 26, 2026: Infisical Agent Vault for most teams (an HTTP proxy that attaches the real credential on the way out; 5,000 brokered requests a month free, then $2 per 1,000), AWS AgentCore Identity for agents on AWS (free when used through AgentCore Runtime or Gateway, otherwise $0.010 per 1,000 token or API-key requests), Aembit for enterprises governing agent access to MCP servers and SaaS, OpenSandbox Credential Vault for self-hosted sandboxes (Apache 2.0), and 1Password Credential Broker for 1Password customers once it leaves private beta.

Published: October 26, 2026

The short answer

Use a broker so that the agent never sees the real credential. The best tools for brokering secrets to AI agents at runtime, as of October 26, 2026:

Infisical Agent Vault — best for most teams; a proxy injects credentials into outbound HTTP calls.
AWS AgentCore Identity — best for agents running on AWS.
Aembit — best for enterprises governing agent access to MCP servers and SaaS.
OpenSandbox Credential Vault — best free, self-hosted option for sandboxed agents.
1Password Credential Broker — best for 1Password customers, once it reaches general availability.

This page is the runtime half of our best secrets managers for AI agents guide, which covers the vaults themselves.

The comparison

Tool	How it brokers	Price (Oct 26, 2026)	Self-host	Best for
Infisical Agent Vault	HTTP credential proxy: agent sends a placeholder, proxy checks method/path rules and attaches the real credential	5,000 brokered requests/month free, then $2 per 1,000	✅ self-hosted proxies	Coding agents, custom harnesses
AWS AgentCore Identity	Issues OAuth tokens and API keys to agents, on behalf of users or the agent itself	Free via AgentCore Runtime/Gateway; otherwise $0.010 per 1,000 requests	❌	Agents on AWS
Aembit	Workload identity; short-lived scoped credentials at runtime; OAuth 2.1 for MCP clients	Free tier; paid plans	❌	Enterprise agent fleets, MCP servers
OpenSandbox Credential Vault	Egress sidecar injects auth headers into allowed HTTPS requests; sandbox gets fake values	Free (Apache 2.0)	✅	Self-hosted sandboxes on Docker/Kubernetes
1Password Credential Broker	Workload proves identity (GitHub Actions, OIDC), receives only approved credentials	Private beta since June 15, 2026	❌	Existing 1Password customers

1. Infisical Agent Vault — best for most teams

Agent Vault is the purest form of the pattern. The agent calls an API with a placeholder; the proxy checks the request against method and path rules, attaches the real credential and forwards it. The secret never enters the context window, shell history or logs, so a prompt-injected agent cannot print it. It supports time-bound agent sessions, access bundles, substitutions, traffic policy and session logs (30-day retention on Pro), and you can run the proxies yourself. Pricing is per brokered request: the first 5,000 each month are free, then $2 per 1,000. A coding agent making 100 authenticated calls a day stays inside the free allowance. It works with Claude Code, OpenClaw and custom harnesses.

2. AWS AgentCore Identity — best on AWS

AgentCore Identity lets agents reach AWS resources and third-party tools — Slack, GitHub, Zoom — with OAuth tokens or API keys it manages, on behalf of a user or the agent itself, against identity providers such as Cognito, Okta or Entra ID. It costs nothing extra when you use it through AgentCore Runtime or AgentCore Gateway; otherwise AWS bills $0.010 per 1,000 successful token or API-key requests. AWS’s own example — 10,000 users, five sessions, three tools — comes to $1.50 a month. The catch is lock-in: it is the right answer only if the agent already runs on AgentCore.

3. Aembit — best for enterprise governance

Aembit positions itself as an identity control plane for agents and workloads. It replaces long-lived credentials with short-lived, scoped credentials issued at runtime, and its IAM for Agentic AI product (generally available since June 2026, with a free tier) implements the MCP specification’s OAuth 2.1 flow so that AI clients — including employees’ personal agents — receive governed access tokens instead of holding credentials for MCP servers. Choose it when security owns agent access across many teams, clouds and SaaS tools.

4. OpenSandbox Credential Vault — best free and self-hosted

OpenSandbox, the Alibaba sandbox platform donated to the Agentic AI Foundation on October 22, 2026, ships a Credential Vault in its egress sidecar. The host-side SDK writes real credentials to the sidecar; processes in the sandbox only get fake or empty values; when Claude Code, git, curl or a package manager makes an allowed HTTPS request, the sidecar injects the right authentication header. It refuses to activate unless egress runs in dns+nft mode, because DNS-only filtering can be bypassed with direct IP connections, and it expects a deny-by-default outbound policy. Free under Apache 2.0, but you operate it.

5. 1Password Credential Broker — for 1Password shops

1Password Credential Broker authenticates machine workloads and agents at runtime and delivers only the credentials each job is approved for, with no standing vault access and full attribution on every delivery. It starts with GitHub Actions and any system that issues an OIDC token. It entered private beta on June 15, 2026, with GA targeted for late 2026 — evaluate it now if your company already stores everything in 1Password.

How to choose

One team, coding agents calling SaaS APIs: Infisical Agent Vault.
Agent built on Bedrock AgentCore: AgentCore Identity — it is already included.
Security team governing dozens of agents and MCP servers: Aembit.
Agents in your own sandboxes, no SaaS dependency: OpenSandbox Credential Vault.
Whatever you choose: pair the broker with deny-by-default egress — a broker protects the secret, egress control stops the agent sending your data to an attacker’s server. See egress control strategies for AI agents and how to give AI agents credentials without leaking them.

Last verified: October 26, 2026.