What are the best practices for short-lived credentials for AI agents?

Mint a new credential per task instead of giving the agent a standing key; scope it to one resource and one action; set the shortest lifetime the task allows (15 minutes is the AWS STS minimum, 1 hour is the default for GitHub App installation tokens and Google Cloud service-account tokens); issue it from a broker outside the model's context so the agent never sees the long-lived secret; log every issuance with the agent and task ID; and revoke on task end rather than waiting for expiry.

How long should an AI agent's credential live?

As short as the task: 5 to 15 minutes for a single tool call or deploy step, up to 1 hour for a coding session. AWS AssumeRole accepts 900 to 43,200 seconds (15 minutes to 12 hours), with role chaining capped at 1 hour. GitHub App installation tokens always expire after 1 hour. Google Cloud short-lived service-account access tokens default to a 1-hour maximum, extendable to 12 hours only by organization policy.

Is a short-lived token enough to stop credential leaks from AI agents?

No. A short lifetime limits how long a leaked token works, not what it can do in that window. Combine it with narrow scope, keeping the token out of the model's context (inject it at the tool boundary), deny-by-default network egress so a stolen token has nowhere to go, and audit logs that tie each token to an agent and task.

Quick Answer

Short-Lived Credentials for AI Agents: Best Practices 2026

Published: October 7, 2026

The short answer

Never give an AI agent a standing key. Have a broker mint a credential per task, scoped to one resource, valid for minutes, injected at the tool boundary, and revoked when the task ends. Every major platform supports this natively in 2026; the work is wiring it into your agent runtime.

Native lifetimes you can rely on (October 2026)

Platform	Mechanism	Lifetime	Scope controls
GitHub	GitHub App installation access token	Always expires after 1 hour	Per-repository and per-permission at mint time
AWS	STS `AssumeRole`	900–43,200 s (15 min–12 h); role chaining max 1 h	Session policies narrow the role (result = intersection); session tags for ABAC
Google Cloud	Short-lived service-account access token	Default max 1 hour; up to 12 h only if org policy allows	Impersonate a dedicated, minimally-privileged service account
HashiCorp Vault	Dynamic secrets with leases	Any TTL you set; revoked automatically on expiry	Per-role policies; revoking an AWS lease deletes the keys

The seven practices

One credential per task, not per agent. An agent identity is long-lived; its credentials should not be. When the orchestrator starts a task (“open a PR on repo X”), it requests a token for exactly that.
Scope at mint time. A GitHub App token can be limited to one repository and contents: write; an AWS session policy can cut a broad role down to one bucket prefix. Anything the task doesn’t need is removed before the token exists.
Shortest lifetime that finishes the job. 15 minutes for a deploy step, 1 hour for an interactive coding session. If a task runs longer, re-mint; don’t raise the TTL.
Keep the long-lived secret out of the model. The private key, Vault token or OIDC trust lives in the broker or tool server. The model calls a tool; the tool attaches the short-lived credential to the outgoing request. Nothing the model can print or be injected into reveals a secret.
Revoke on completion. Expiry is the backstop, not the plan. Vault leases and GitHub installation tokens can be revoked explicitly when the task ends or the agent is stopped.
Log issuance with context. Record agent ID, task ID, scope, TTL and requester for every mint. AWS session tags and Google service-account impersonation logs carry this into the provider’s audit trail.
Pair it with egress control. A token is only useful to an attacker if it can be sent somewhere. Deny-by-default outbound networking for the agent sandbox turns a leaked 1-hour token into a non-event.

Reference flow

agent → tool call "create_pr(repo)" → broker
broker: check policy(agent, task, repo) → mint GitHub App token (repo-scoped, 1 h)
tool server: attach token → GitHub API
task done → broker revokes token → audit log entry

Common mistakes

Personal access tokens in .env. Long-lived, broad, tied to a human. Replace with a GitHub App.
Long TTL “to avoid failures”. Fix the refresh path instead; GitHub’s SDKs regenerate installation tokens automatically when they expire.
One role for all agents. You cannot revoke one misbehaving agent without stopping all of them.

The end-to-end architecture (boundary injection, egress, file primitives, audit) is in how to give AI agents credentials without leaking them; identity, sandboxing and rotation drills are in how to secure AI agent credentials.

Last verified: October 7, 2026.

The short answer

Native lifetimes you can rely on (October 2026)

The seven practices

Reference flow

Common mistakes

Related

Sources