Your agent can use the key. It can't read it.
Store an API key once. Your agents refer to it by name, Minion fills it into the request on the way out, and the value never enters a prompt, a log or a response.
Used by name, sent only where you allow
Never shown
Secrets are encrypted at rest. Code uses them as a placeholder, like {{secret:stripe_key}}, and no capability ever returns the value.
Approved hosts only
An owner or admin decides which hosts each key may be sent to. A request anywhere else is refused before the key is looked up.
Redacted on the way back
If an API echoes a key back in its response, Minion strips it out before the agent sees it.
The details that matter
Encrypted in transit
Keys are only ever sent over https. A plain http request with a key in it is refused.
Expiry
Give a key an expiry date and Minion reminds you before it runs out.
Members use, admins manage
Every member's agent can use a key by name. Only owners and admins create, rotate or delete keys and approve where they go.
Where API keys usually end up
Keep your keys out of the prompt
Store one key, approve where it may go, and let any agent use it by name.