Put static secrets in your HTTP proxy: exe.dev on agent-era key management
davidcrawshaw · x · 2026-11-04
exe.dev's blog argues static secrets like API keys should live in a reverse proxy, not on the app VM — manage third-party integrations via HTTP header injection (they do this for OAuth secrets too). The root problem predates agents: API keys are too powerful, granting holders the ability to re-share access. Agents sharpen it: some models refuse to act once they "see" a key, others write it into cross-session memory and burn context on revoked keys. Moving secret handling to the proxy layer keeps keys away from models and app code.
More from coding & agent
- GhostDraw: a hobbyist turns hand-drawn sketches into app diagrams with tldraw and AI — Dhananjay_Tech · 2026-11-04
- CoworkOS Debuts: Three-Layer Agent Coworker Framework Lifts Qwen3.6 by 9.76 Points — KyeGomezB · 2026-11-04
- DOLORES: Training-Free Meta-Scaffold Lifts 8B Models Past 32B Baselines — StellaLisy · 2026-11-04
- Berkeley-affiliated StarTrail open-sources a deep research benchmark and paper-search toolkit — CShorten30 · 2026-11-04
- AI job-search framework built on Claude Code hits 69.3k GitHub stars — adnan_hashmi · 2026-11-04
- DuplexAgent-RSI separates live speech from async agent work in voice assistants — jiqizhixin · 2026-11-04