Credentials in managed agents

Credentials are server-managed secrets that let your agents reach third-party services without the secret ever entering the agent's environment. You store a credential once, reference it by ID, and the egress proxy resolves and injects it at request time.

Secret values are write-only. Once stored, they are never returned by any endpoint, so a compromised agent cannot read back the tokens it is using.

The primary place you use a credential is the network allowlist on environment.network. Store the secret first:

Python

from google import genai

client = genai.Client()

credential = client.credentials.create(
    id="github-production",
    type="bearer_token",
    token="ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
)

print(f"Credential ID: {credential.id}, Status: {credential.status}")

JavaScript

import { GoogleGenAI } from "@google/genai";

const client = new GoogleGenAI({});

const credential = await client.credentials.create({
    id: "github-production",
    type: "bearer_token",
    token: "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
});

console.log(`Credential ID: ${credential.id}, Status: ${credential.status}`);

REST

curl -X POST "https://generativelanguage.googleapis.com/v1beta/credentials" \
-H "Content-Type: application/json" \
-H "x-goog-api-key: $GEMINI_API_KEY" \
-d '{
    "id": "github-production",
    "type": "bearer_token",
    "token": "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}'

Then attach it to the domain it authenticates:

Python

interaction = client.interactions.create(
    agent="antigravity-preview-09-2026",
    input="Triage the open issues in my-org/my-repo.",
    environment={
        "type": "remote",
        "network": {
            "allowlist": [
                {"domain": "api.github.com", "credential": "github-production"},
                {"domain": "*"},
            ]
        },
    },
)

JavaScript

const interaction = await client.interactions.create({
    agent: "antigravity-preview-09-2026",
    input: "Triage the open issues in my-org/my-repo.",
    environment: {
        type: "remote",
        network: {
            allowlist: [
                { domain: "api.github.com", credential: "github-production" },
                { domain: "*" },
            ],
        },
    },
});

REST

curl -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \
-H "Content-Type: application/json" \
-H "x-goog-api-key: $GEMINI_API_KEY" \
-d '{
    "agent": "antigravity-preview-09-2026",
    "input": "Triage the open issues in my-org/my-repo.",
    "environment": {
        "type": "remote",
        "network": {
            "allowlist": [
                { "domain": "api.github.com", "credential": "github-production" },
                { "domain": "*" }
            ]
        }
    }
}'

The agent now makes authenticated requests to api.github.com, and the token never exists inside the sandbox.

Credential types

Every credential has a type that determines which fields it accepts and how the proxy applies it.

Type Use case Behavior
bearer_token Personal access tokens, bot tokens, static API keys The proxy injects the token as a request header. No refresh logic.
oauth2 OAuth apps and user-delegated flows The proxy exchanges the refresh token for access tokens and refreshes them as they expire.
environment_variable Client SDKs that read secrets from the process environment The agent's environment receives a placeholder. The proxy substitutes the real secret on outbound requests.

Use credentials in the network allowlist

Add credential to an allowlist rule and the proxy authenticates every outbound request to that domain. This is the recommended way to give an agent access to a private API, a private repository, or a private bucket.

You can mix authenticated and unauthenticated rules in the same allowlist:

Python

interaction = client.interactions.create(
    agent="antigravity-preview-09-2026",
    input="Sync the open Jira issues into the tracking sheet in my repo.",
    environment={
        "type": "remote",
        "sources": [
            {
                "type": "repository",