Philipp Schmid· @_philschmid · X·· 29 天前AI 评分49
AI 导读
把 API key 或密钥当作普通环境变量传入，会让智能体沙箱里的任何依赖读取并可能泄露它们。 Gemini Managed Agents 的 Credentials API 可确保密钥安全，仅在传输时针对受信任域名注入，因此沙箱代码无法访问原始 token。适用于环境变量、CLI 和 MCP Server。 了解更多 👇
正文 · 原文
Passing API keys or secrets as normal env lets any dependency in your agent's sandbox read and potentially leak them.
The Credentials API for Gemini Managed Agents keeps secrets secure and injects them on the wire only for trusted domains, so sandboxed code can't access raw tokens. Works for environment variables, CLIs and MCP Server.
Learn more 👇
https://x.com/i/article/2104585345740210176在 X 查看被引用的帖子
来源：Philipp Schmid · x.com