---
title: "Agent Credential Access API | Gazebo Docs"
description: "Retrieve a connected service credential with a scoped Gazebo agent token and method-level policy enforcement."
url: "https://gazebohq.com/docs/api/agent-access"
---

The Agent REST API lets a custom agent retrieve credentials without speaking MCP. Use an [agent token](/docs/api/authentication), not an account API token.

## Retrieve one service's credentials

```
GET /api/agents/me/credentials/{service}?method={method}&key_name={key_name}
```

```bash
curl "https://app.gazebohq.com/api/agents/me/credentials/stripe?method=GET" \
  -H "Authorization: Bearer YOUR_AGENT_TOKEN"
```

`service` is Gazebo's normalized service identifier. `method` represents the HTTP method the agent intends to use and must be one of `GET`, `POST`, `PUT`, `PATCH`, or `DELETE`. If omitted, it defaults to `GET`.

`key_name` is optional. When omitted, Gazebo returns one deterministic primary credential, preferring `api_key` when present. Supply `key_name` to retrieve a different named credential. The endpoint never returns an implicit bundle of every key for the service.

### Success response

```json
{
  "service": "stripe",
  "credentials": {
    "api_key": "credential-value"
  }
}
```

Credential values are returned to the authenticated agent process. Do not log, persist, or send this response to a browser.

### Access denied

If the service or method is not allowed by the agent's policy, Gazebo returns `403`:

```json
{
  "status": "denied",
  "service": "stripe",
  "method": "DELETE",
  "allowed_methods": ["GET"],
  "reason": "This agent is not permitted to use DELETE on stripe.",
  "next_action": "Update the access policy at gazebohq.com/agents"
}
```

Every successful, denied, or not-found credential request creates an [audit event](/docs/api/audit-events).

## Bulk retrieval

Gazebo has an existing compatibility endpoint at `GET /api/agents/me/credentials`. It is not the recommended integration path because one request may return credentials for multiple services. New integrations should request one service at a time.

## MCP alternative

MCP-native clients should use Gazebo's [`get_credential`](/docs/mcp/get-credential) tool. It applies the same agent service and method policy.