Store agent keys and recovery secrets outside model context

Inventory more than the bearer token

A Lupin API key authorizes resource access, but it is not the only sensitive value in an agent integration. The autonomous registration Idempotency-Key can recover the original API key on an identical replay and must be protected like that key. A browser live-view or control URL grants session access while valid, and a webhook signing secret authenticates deliveries. Provider authorization links and signed attachment URLs can also carry sensitive access. Classify these values by purpose and lifetime rather than assuming anything called a URL is safe to paste into a prompt.

Persist before calling without exposing state

Save the registration secret and exact username before the first public registration request. Use private directories or a secret manager, write pending responses separately and validate successful required fields before promoting them atomically. Set restrictive file access if using local storage and keep files outside the repository. Do not enable shell tracing around credential loading. A JSON response containing api_key belongs in private credential state, not a CI artifact, copied example or shared conversation transcript. Preserve original state during retries rather than replacing a valid record with a server error body.

Keep credentials in the transport layer

The HTTP client should attach Authorization: Bearer from runtime configuration. The model needs resource references and tool schemas, not the raw credential. Select the secret from a trusted tenant-and-role mapping on the server, then validate the requested resource inside that boundary. Do not let an email or provider result choose a secret name or supply an alternate bearer value. An inbox-scoped key reduces the impact of a compromised worker, while a broad owner key in every agent process makes a small prompt-injection failure much more consequential.

Redact logs without assuming perfection

Log structured status, operation ID and error code where useful, while excluding request headers, raw registration bodies, OTPs, control links and private correspondence. Some error or recovery responses can contain credentials, so do not print every non-success body automatically. Diagnostic redaction is a defense layer, not a promise to recognize arbitrary new secrets embedded in natural language. Keep production traces private, choose minimal capture by default and avoid enabling broad content capture merely to troubleshoot a simple permission error.

Rotate by identity and role

Store api_key_id separately from key material so an operator can revoke a known worker credential without searching logs for the raw token. Issue a replacement through an authorized parent, update the worker’s secret reference and retire the old key deliberately. The original bootstrap key cannot mint a replacement, and replaying registration does not restore a revoked key. Human claim supplies an ownership path while preserving the bootstrap restriction. Never make a broad parent key the automatic fallback when a limited key stops working.

Practice recovery with synthetic credentials

Build a fixture that revokes a worker key, confirms reads fail and verifies the agent reports the missing access instead of registering a replacement workspace. Check that captured logs contain no raw token or recovery secret. Your next step is a credential inventory with owner, scope, storage location, rotation trigger and revocation procedure for each value the integration handles.

Sources & verification

Reviewed against checked-in Lupin API handlers and documentation. Example requests were not executed against live providers.

• Lupin credential safety ↗Checked 2026-11-05
• Lupin registration recovery secret ↗Checked 2026-11-05
• Lupin browser control URL boundary ↗Checked 2026-11-05

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.