Secure agents, APIs, and model access
AI Security & Credentials
AI applications connect models to data and tools, which makes identity and permission design part of the product architecture. Protecting one provider key is not enough: you need to know which actor can do what, where credentials live, how they rotate, and how access is revoked.
Decisions this guide helps you make
- Which identity represents the user, application, agent, or external tool.
- Where development, CI, and production credentials should live.
- How to grant narrow, revocable permissions instead of shared master access.
- How to audit and recover when an agent or integration behaves unexpectedly.
Separate identities and credentials
Users, backend services, agents, and external tools should not share one long-lived master key.
Authentication for AI applications
Choose API keys, OAuth, JWTs, and service identities by actor and trust boundary.
Read guide →AI agent authentication
Design scoped identity for autonomous and semi-autonomous software.
Read guide →MCP authentication guide
Protect MCP servers and understand delegated tool access.
Read guide →SSH for AI servers
Secure administrative access to GPU machines and self-hosted models.
Read guide →TLS for AI APIs and agents
Protect gateways, model services, MCP connections, and streaming traffic.
Read guide →Manage secrets across environments
A development password manager, a CI secret, and a production vault solve related but different problems.
API keys and secrets for AI agents
Compare password managers, secret stores, vaults, and deployment integrations.
Read guide →Environment variables and AI API keys
Move credentials safely from a local shell to CI and production.
Read guide →OAuth for developers
Understand delegated authorization before giving an agent access to user data.
Read guide →Limit the blast radius
Assume prompts, tools, logs, and dependencies can fail. Scope permissions and keep recovery possible.
Cloudflare Sandbox for AI agents
Isolate agent-executed code and control its runtime boundary.
Read guide →AI governance for startups
Document owners, data, controls, evaluation, and incident decisions.
Read guide →API authentication compared
Map each caller to the narrowest practical credential.
Read guide → Quality layerTest agent permissions and approval boundaries
Validate tool access, recovery, audit traces, and human approval before release.
Read guide →