The per-user vault

Your tools often act on behalf of the person chatting, not on behalf of you. Alice's GitHub token, Bob's Stripe key, each customer's CRM credential. The vault holds one secret per user, encrypted with Fernet at rest, and injects it into tool auth at call time. The raw secret is placed in the outbound request, never in the prompt, so the model can trigger the action without ever reading the credential.

You write secrets server to server, never from the browser. Send the user's signed identity plus the name and value to PUT /v1/credentials. Signed identity proves the request is really for that user, so a client cannot write into someone else's vault. The signer below mirrors the server's canonical JSON, escaping every non-ASCII character to its \uXXXX form so an Arabic or other Unicode identity still produces a matching signature.

import { createHmac } from "crypto";

// Canonical JSON, byte-for-byte what Agentifys verifies against:
//   json.dumps(ctx, sort_keys=True, separators=(",", ":"))   # ensure_ascii=True by default
// Three things diverge if you hand-roll this with JSON.stringify:
//   1. every non-ASCII char must become \uXXXX (an Arabic name signs wrong otherwise),
//   2. keys sort by Unicode CODE POINT, not UTF-16 code unit (differs above the BMP),
//   3. only integers are safe (Python renders 1e-7 as 1e-07).
function enc(v) {
  return JSON.stringify(v).replace(/[^ -~]/g,
    c => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0"));
}
const codePoints = (s) => Array.from(s, (c) => c.codePointAt(0));
function byCodePoint(a, b) {
  const A = codePoints(a), B = codePoints(b);
  for (let i = 0; i < Math.min(A.length, B.length); i++) if (A[i] !== B[i]) return A[i] - B[i];
  return A.length - B.length;
}
function canonicalJson(v) {
  if (Array.isArray(v)) return "[" + v.map(canonicalJson).join(",") + "]";
  if (v && typeof v === "object") {
    return "{" + Object.keys(v).sort(byCodePoint)
      .map((k) => enc(k) + ":" + canonicalJson(v[k])).join(",") + "}";
  }
  if (typeof v === "number" && !Number.isInteger(v)) {
    throw new Error("Sign integers only: " + v + " formats differently in Python. Send it as a string.");
  }
  return enc(v);
}

// Add _ts (unix seconds), sign the context WITHOUT _sig, then send { ...identity, _ts, _sig }.
// Valid for 5 minutes, and re-checked on every /v1/chat call.
function signUserContext(identity, secret) {
  const ctx = { ...identity, _ts: Math.floor(Date.now() / 1000) };
  ctx._sig = createHmac("sha256", secret).update(canonicalJson(ctx)).digest("hex");
  return ctx;
}

const ctx = signUserContext({ id: "u_123" }, process.env.ERA_IDENTITY_SECRET);

const res = await fetch("https://agentifys.ai/v1/credentials", {
  method: "PUT",
  headers: {
    Authorization: "Bearer era_your_project_key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    user_context: ctx,
    name: "github_token",
    value: "ghp_ABCD1234EFGH5678wxyz",
  }),
});
const { name, secret_hint } = await res.json();

The response only ever hands back a masked hint, never the value. The hint is the first eight characters, an ellipsis, and the last four; a value of eight characters or fewer masks to **** entirely.

{
  "name": "github_token",
  "secret_hint": "ghp_ABCD...wxyz"
}

List the masked hints or revoke a secret with the same signed identity. On these two the identity travels as a user_context query parameter, URL-encoded JSON, because there is no request body to carry it:

Once a secret is stored, reference it by name in any tool auth header or MCP connection token with the {{user.creds.<name>}} placeholder. At call time Agentifys swaps the placeholder for the decrypted value. The name in the placeholder must match the name you provisioned, exactly.

A webhook tool has no auth section. Its credentials live in webhook_headers — the same dictionary as every other header — or, less commonly, in webhook_params. Those two are the only fields where a placeholder resolves: webhook_url is used literally, and so are the arguments the model produced.

// The tool's webhook_headers. There is no "auth" object.
{
  "Authorization": "Bearer {{user.creds.github_token}}"
}

For a remote MCP server that uses bearer or header auth, put the placeholder in the token field instead, on its own. With bearer auth Agentifys prefixes Bearer  for you; with header auth the resolved value is sent exactly as stored, under the header name you chose (or X-API-Key if you left it blank). Either way, when Alice chats her token is injected; when Bob chats his is. Same tool, per-user credentials.

{{user.creds.github_token}}