CapabilitiesKeys and secrets
Secrets the agent cannot read
Keys are added to outgoing requests by the provider, so the agent never sees them.
Who offers it
Part of Keys and secrets, which explains why it matters.
Fully: boxd, Cloudflare Sandbox, Daytona, E2B, InstaBox, Runtime and Vercel Sandbox. With a catch: Blaxel, Boat, Modal and Sprites. Not at all: Agent 37, Lizard, Sandboxer and Tensorlake.
The machine holds a worthless stand-in and the real value is added only for the hosts you named.
docs-confirmed “Inside the machine `STRIPE_KEY` is an opaque string starting with `bxds_`.” Source
Your own small program adds the key after the request leaves the machine, so the agent never holds it.
docs-confirmed “A Container can send its request without the credential, and an outbound handler in your Worker adds the credential after the request leaves the sandbox.” Source
The real value is added only in one fixed part of the request, so a service that wants it in the body or the address cannot be called this way.
docs-confirmed “The proxy substitutes placeholders in HTTPS request headers only.” Source
The value is added to matching requests outside the machine, so the agent never sees it.
docs-confirmed “The egress proxy injects the real value into matching outbound HTTPS requests outside the sandbox.” Source
Only encrypted web requests are covered; the value cannot go into a web address or a request body.
docs-confirmed “Version one supports HTTPS on port 443; URL parameters and request bodies are not substituted.” Source
The machine holds a stand-in and the real value is added only for the hosts you named.
docs-confirmed “The machine sees a placeholder. The value is added only to HTTPS requests to the hosts you name.” Source
Keys are added to outgoing traffic and never enter the machine, so code inside cannot copy them.
docs-confirmed “Credentials brokering injects credentials into egressing traffic. The secrets never enter the sandbox” Source
The catch: The feature is a public preview, and programs that ignore its settings can bypass it.
docs-confirmed “The Blaxel proxy intercepts outbound HTTPS requests from the sandbox and injects headers, body fields, and secrets server-side.” Source
The catch: Only model-provider keys go through the key service; other API keys are ordinary variables the agent can read.
docs-confirmed “A placeholder is worthless outside boat. It does not contain the real key.” Source
The catch: The feature that hides keys is in beta and cannot be changed once set up.
docs-confirmed “This replacement happens outside the Sandbox so the secret never appears in the Sandbox's environment.” Source
The catch: Only the services in its catalogue are covered; any other key has to go into the machine.
docs-confirmed “Connectors solve this by storing the credential once, in your organization, and routing API calls through the Sprites gateway. Sprites never see the token.” Source
- Agent 37No
Note: There is no service that adds keys for you; a key you give the machine is a key the agent can print.
docs-confirmed “Anything in an instance's environment, the agent can read and repeat back.” Source
- LizardNo
Note: There is no service that adds keys for you; keys are variables the agent can read.
docs-confirmed “Create-time `envs` reach every command.” Source
Note: Keys are written into the machine as variables and files, so the agent can read them.
docs-confirmed “Variables — a `.env`-style list, exported to every process in the sandbox.” Source
Note: There is no service that adds keys to requests; the machine holds whatever you pass it.
inferred “Set per-command and per-PTY environment variables” Source
- MorphNot published
A secrets manager exists, but whether a service keeps values out of the machine is not published.
inferred “Every devbox is created from a template that integrates with our secrets manager” Source
Related
Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.