OneCLI - Open-source credential gateway for AI agents
Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents
OneCLI is an open-source credential gateway that secures AI agents by keeping API keys hidden. Instead of embedding sensitive secrets in code, developers store credentials once in OneCLI's encrypted vault. The Rust-based gateway transparently injects real keys into HTTP requests, swapping them for safe placeholders before agents ever see them. This architecture simplifies key rotation, centralizes access control, and prevents accidental exposure of secrets across multiple agents. With support for Google OAuth and Bitwarden integration, OneCLI offers a robust, easy-to-deploy solution for managing authentication in modern AI workflows.
Store once. Inject anywhere. Agents never see the keys.
- sandeepkd
It works great for static credentials. As a product I think about adding couple more things that might be helpful here (Btw I am not the client for this, I just happen to know them as practical problems)
1. Support for OAuth Client credentials - Gateway does the OAuth dance to get the access token, this is quite practical and even useful in case of regular services running across clusters and sharing the same clientId-secretId
2. Support for request retries on certain failures and short circuiting in other cases
- emilsoman
How does it compare to agent-vault and clawpatrol?
- vayup
MITM is a feature now.
- redbridgerock
Oo this is interesting, blocking it on the network level is nice
- osinix
This is the same old good way from database world. A db client never touches the disk, but sends requests to a server who owns it. Same in your product. Keys are separated from agents and if needed, agents must send request to a proxy who owns them. Old proven design. Good luck.