Stop Pasting Secrets Into AI Agents

import requests
from google.adk import Agent

TOKENVAULT_URL = "https://api.tokenvault.uk/api/agents/credentials"
AGENT_KEY = "tvagent_abc123..."  # store in env var in production

def get_credential(service: str) -> str:
    """Fetch a fresh credential from Token Vault."""
    resp = requests.get(
        TOKENVAULT_URL,
        params={"service": service},
        headers={"Authorization": f"Bearer {AGENT_KEY}"},
    )
    resp.raise_for_status()
    return resp.json()["accessToken"]

# Build an ADK agent that uses Token Vault for credentials
agent = Agent(
    name="code_reviewer",
    model="gemini-2.0-flash",
    instruction="""You are a code review assistant.
    Use the github tool to read pull requests and leave review comments.""",
)

@agent.tool
def github_api(endpoint: str, method: str = "GET", body: str = ""):
    """Call the GitHub API with a fresh token from Token Vault."""
    token = get_credential("github")
    resp = requests.request(
        method,
        f"https://api.github.com{endpoint}",
        headers={
            "Authorization": f"Bearer {token}",
            "Accept": "application/vnd.github.v3+json",
        },
        json=body if body else None,
    )
    return resp.json()