---
title: "Core Concepts | Gazebo Docs"
description: "Key concepts in Gazebo — services, vault, access profiles, agents, bearer tokens, and audit logs explained."
url: "https://gazebohq.com/docs/concepts"
---

## Services

A service is an external API that Gazebo manages credentials for — Stripe, GitHub, Cloudflare, Vercel, Resend, OpenAI, and others. When you connect a service, you provide the API key or OAuth token for that service. Gazebo encrypts and stores it in the vault.

## Vault

The vault is the encrypted store of your service credentials. Each credential is encrypted with AES-256-GCM before being written to disk. Plaintext values are never returned to a browser after initial storage — they are only ever decrypted to fulfill an authorized agent credential request.

See [Credential storage](/docs/security/credential-storage) for the full details.

## Access profiles

An access profile is a named credential-release policy. It defines which services may release credentials to an agent and which declared HTTP methods permit release.

Profiles are Gazebo's unit of authorization. They control credential retrieval, while provider-side key scopes, OAuth scopes, and IAM permissions control what a released credential can actually do.

## Agents

An agent is an AI tool or automated process that needs access to your service credentials. In Gazebo, an agent is represented by:

- A name (e.g. `cursor-dev`, `deploy-bot`)
- A linked access profile (what it's allowed to access)
- A bearer token (how it authenticates with Gazebo)

An agent in Gazebo is not the AI model itself — it's the identity and permission set you assign to a particular tool or workflow.

## Bearer tokens

A bearer token is the credential an agent uses to authenticate with Gazebo. It's a secret string, formatted `ag_...`, that the agent includes in every request to Gazebo.

The token identifies the agent and resolves its access policy. It does not contain credential values — those are fetched per-request by calling `get_credential`.

Tokens are issued when you create or regenerate an agent. They do not expire automatically but can be revoked by deleting the agent.

## Audit logs

Every call to `get_credential` — successful or denied — is recorded in the audit log with:

- The agent identity
- The service requested
- The HTTP method requested
- The outcome (success or denial reason)
- The timestamp

Audit logs are append-only. They cannot be deleted from the dashboard.