Credentials API — Store and Retrieve Agent Secrets

The vault stores logins, API keys, and TOTP secrets on behalf of each agent. Credential values never appear in chat transcripts or server logs — they are read through scoped API calls, and every access is recorded in the org’s audit history.

List credentials

GET /api/v1/vault returns account metadata only. Values are never included in the list response. Requires vault:metadata.

List credentials

curl -s https://agent-loadout.com/api/v1/vault \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN"

string

Unique credential identifier.

string

Human-readable label set when the credential was created.

string

One of login, api_key, or totp.

string

Present when kind is login.

boolean

Whether the credential’s value can be read by the agent via GET /api/v1/vault/:id.

Get one credential

GET /api/v1/vault/:id returns the value of a single credential. Requires vault:use, and the credential must be marked agent-readable.

Every credential read is recorded in the org’s audit history, including which agent read it and when.

Create a credential

POST /api/v1/vault stores a new credential. Requires vault:write.

Create a credential with a generated password

curl -s -X POST https://agent-loadout.com/api/v1/vault \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Error tracker","kind":"login","username":"support@loadout.email","generate":true,"allowed_origins":["https://app.tracker.example"]}'

When generate is true, the generated password is returned once in the create response. After that, only GET /api/v1/vault/:id (or the get_credential MCP tool) can read it, and every read is logged.

Request body

string

required

Human-readable label for the credential.

string

Type of credential: login, api_key, or totp. Defaults to login.

string

Username or email address. Used when kind is login.

string

Explicit password to store. Mutually exclusive with generate.

boolean

Set to true to have the vault generate a strong password. The value is returned once in this response only.

array

List of origin URLs where this credential may be used by the local connector.

string

Base32-encoded TOTP secret. Required when kind is totp. The raw secret is never returned by any endpoint after creation.

Rotate or update a credential

PATCH /api/v1/vault/:id rotates a password or adds a TOTP secret to an existing credential. Requires vault:write. Use the MCP tool update_credential for the same operation from a chat client.

MCP tools for the vault

Use these MCP tools when working from a client like Claude Code, Codex, or Cursor:

Tool	Scope required	Description
`list_credentials`	vault:metadata	Account metadata without values
`get_credential`	vault:use	Value of an agent-readable credential
`create_credential`	vault:write	Store a new account, optionally with a generated password
`update_credential`	vault:write	Rotate a password or add an authenticator secret

Issue tokens with only the vault scopes each client needs. A read-only integration needs only vault:metadata; one that fills in passwords needs vault:use; one that creates accounts needs vault:write.

Overview

Email

Vault

Machines

MCP

Credentials API — Store and Retrieve Agent Secrets

List credentials

Get one credential

Create a credential

Request body

Rotate or update a credential

MCP tools for the vault

​List credentials

​Get one credential

​Create a credential

​Request body

​Rotate or update a credential

​MCP tools for the vault

List credentials

Get one credential

Create a credential

Request body

Rotate or update a credential

MCP tools for the vault