Agent credential access

The Agent REST API lets a custom agent retrieve credentials without speaking MCP. Use an agent token, not an account API token.

Retrieve one service's credentials

GET /api/agents/me/credentials/{service}?method={method}&key_name={key_name}

curl "https://app.gazebohq.com/api/agents/me/credentials/stripe?method=GET" \
  -H "Authorization: Bearer YOUR_AGENT_TOKEN"

service is Gazebo's normalized service identifier. method represents the HTTP method the agent intends to use and must be one of GET, POST, PUT, PATCH, or DELETE. If omitted, it defaults to GET.

key_name is optional. When omitted, Gazebo returns one deterministic primary credential, preferring api_key when present. Supply key_name to retrieve a different named credential. The endpoint never returns an implicit bundle of every key for the service.

Success response

{
  "service": "stripe",
  "credentials": {
    "api_key": "credential-value"
  }
}

Credential values are returned to the authenticated agent process. Do not log, persist, or send this response to a browser.

Access denied

If the service or method is not allowed by the agent's policy, Gazebo returns 403:

{
  "status": "denied",
  "service": "stripe",
  "method": "DELETE",
  "allowed_methods": ["GET"],
  "reason": "This agent is not permitted to use DELETE on stripe.",
  "next_action": "Update the access policy at gazebohq.com/agents"
}

Every successful, denied, or not-found credential request creates an audit event.

Bulk retrieval

Gazebo has an existing compatibility endpoint at GET /api/agents/me/credentials. It is not the recommended integration path because one request may return credentials for multiple services. New integrations should request one service at a time.

MCP alternative

MCP-native clients should use Gazebo's get_credential tool. It applies the same agent service and method policy.