Core concepts

Services

A service is an external API that Gazebo manages credentials for — Stripe, GitHub, Cloudflare, Vercel, Resend, OpenAI, and others. When you connect a service, you provide the API key or OAuth token for that service. Gazebo encrypts and stores it in the vault.

Vault

The vault is the encrypted store of your service credentials. Each credential is encrypted with AES-256-GCM before being written to disk. Plaintext values are never returned to a browser after initial storage — they are only ever decrypted to fulfill an authorized agent credential request.

See Credential storage for the full details.

Access profiles

An access profile is a named credential-release policy. It defines which services may release credentials to an agent and which declared HTTP methods permit release.

Profiles are Gazebo's unit of authorization. They control credential retrieval, while provider-side key scopes, OAuth scopes, and IAM permissions control what a released credential can actually do.

Agents

An agent is an AI tool or automated process that needs access to your service credentials. In Gazebo, an agent is represented by:

A name (e.g. cursor-dev, deploy-bot)
A linked access profile (what it's allowed to access)
A bearer token (how it authenticates with Gazebo)

An agent in Gazebo is not the AI model itself — it's the identity and permission set you assign to a particular tool or workflow.

Bearer tokens

A bearer token is the credential an agent uses to authenticate with Gazebo. It's a secret string, formatted ag_..., that the agent includes in every request to Gazebo.

The token identifies the agent and resolves its access policy. It does not contain credential values — those are fetched per-request by calling get_credential.

Tokens are issued when you create or regenerate an agent. They do not expire automatically but can be revoked by deleting the agent.

Audit logs

Every call to get_credential — successful or denied — is recorded in the audit log with:

The agent identity
The service requested
The HTTP method requested
The outcome (success or denial reason)
The timestamp

Audit logs are append-only. They cannot be deleted from the dashboard.

Core concepts

Services

Vault

See Credential storage for the full details.

Access profiles

An access profile is a named credential-release policy. It defines which services may release credentials to an agent and which declared HTTP methods permit release.

Profiles are Gazebo's unit of authorization. They control credential retrieval, while provider-side key scopes, OAuth scopes, and IAM permissions control what a released credential can actually do.

Agents

An agent is an AI tool or automated process that needs access to your service credentials. In Gazebo, an agent is represented by:

A name (e.g. cursor-dev, deploy-bot)
A linked access profile (what it's allowed to access)
A bearer token (how it authenticates with Gazebo)

An agent in Gazebo is not the AI model itself — it's the identity and permission set you assign to a particular tool or workflow.

Bearer tokens

A bearer token is the credential an agent uses to authenticate with Gazebo. It's a secret string, formatted ag_..., that the agent includes in every request to Gazebo.

The token identifies the agent and resolves its access policy. It does not contain credential values — those are fetched per-request by calling get_credential.

Tokens are issued when you create or regenerate an agent. They do not expire automatically but can be revoked by deleting the agent.

Audit logs

Every call to get_credential — successful or denied — is recorded in the audit log with:

The agent identity
The service requested
The HTTP method requested
The outcome (success or denial reason)
The timestamp

Audit logs are append-only. They cannot be deleted from the dashboard.