Separate configuration from secrets
A reusable agent stores behavior and tool configuration. Reusable credentials belong in a vault. Attach the vault ID when creating a session. This lets a credential be managed without placing the secret directly in a saved agent definition.
Understand the connection boundary
Vault authentication is for service-origin MCP connections. Credentials are matched to the server URL. If multiple credentials match, select the intended credential explicitly. Environment-origin connections need a different authentication approach.
Scope the credential
Use the narrowest downstream permissions needed by the task and restrict the exposed tool set. A vault stores a credential; downstream permissions still determine what the tool can access. Separate tenants and revoke access when it is no longer needed.
Keep secrets out of generated code
Do not put access tokens in prompts, repositories, examples, or sandbox files. A credential injected into an environment can be read by agent-generated code. A trusted broker can inject credentials outside that boundary.
Read the official reference
Check the source for current API fields, account requirements, and service limits.
OpenAI: vaults