How do we protect API keys, credentials, and secrets used by AI agents?

Summary

• Never hard-code secrets in agent code. Store API keys and credentials in Databricks secrets and Unity Catalog secrets, and reference them by name at runtime.
• Give agents governed identities. Agents and services authenticate as service principals, and access is authorized through Unity Catalog privileges with full audit logging.
• Secrets are injected securely at deploy time. Model Serving and Databricks Apps inject secret resources as environment variables so the values stay managed and are not exposed in plaintext.
• Centralize external credentials in the Unity AI Gateway. The gateway controls access to external model providers and MCP servers, so agents connect to outside services without embedding keys in agent code.
• Encryption and network controls throughout. Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher), with IP access lists and Private Link available for network isolation.

How do we protect API keys, credentials, and secrets used by AI agents?

AI agents need API keys and credentials to call tools, models, and external services — and those secrets should never be hard-coded in agent code or prompts. On the Databricks Data Intelligence Platform, you store secrets in managed secret stores, give agents governed identities, inject credentials securely at deploy time, and centralize access to external services through a gateway. Every access is authorized and audited, so secrets stay protected across the agent lifecycle.

Why Databricks Platform for protecting agent secrets

• Managed secret stores. Store API keys and credentials in Databricks secrets or Unity Catalog secrets rather than in code. Secrets are referenced by scope and key at runtime, and you can create and manage Unity Catalog secrets with the databricks secrets-uc CLI commands.
• Governed identities for agents. Agents and automated services authenticate as service principals rather than as individual users, and access is authorized through Unity Catalog privileges. This lets you grant an agent only the credentials and resources it needs and revoke them centrally. See governing AI agents at scale with Unity Catalog.
• Secure injection at deploy time. When you deploy a Databricks App that uses secret resources, the platform injects each secret as an environment variable whose name matches the resource key you defined, so the actual value stays managed and is never exposed in plaintext. Model Serving similarly supports Databricks secrets and Unity Catalog secrets for storing sensitive information such as API keys, and endpoints are authenticated with service principals and authorized through Unity Catalog privileges.
• Centralized access to external services. The Unity AI Gateway controls access to AI services, so agents reach external model providers and Model Context Protocol (MCP) servers through governed connections instead of holding provider keys directly. See how to connect agents to external MCPs securely and new governance capabilities to scale AI agents with confidence.
• Encryption, network controls, and auditing. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Endpoints and apps support IP access lists and Private Link for network isolation, and all requests are logged for audit. Read what's new in platform security and compliance.

Getting started

• Create a secret scope and add your API keys with Databricks secret management, or manage Unity Catalog secrets with the databricks secrets-uc commands.
• Reference secrets as secret resources in a Databricks App so they are injected as environment variables at deploy time.
• Route external model and tool access through the Unity AI Gateway, and review governing AI agents at scale with Unity Catalog.

FAQs

Where should AI agents store API keys and credentials?

In Databricks secrets or Unity Catalog secrets — never hard-coded in agent code or prompts. Agents reference secrets by scope and key at runtime, and the values stay managed by the platform.

How do agents authenticate without exposing credentials?

Agents and services authenticate as service principals, and access is authorized through Unity Catalog privileges. Deployed apps and serving endpoints inject secrets as environment variables so the underlying values are not exposed in plaintext.

How do agents reach external model providers securely?

The Unity AI Gateway controls access to external model providers and MCP servers, so agents connect through governed connections rather than embedding provider API keys in their own code.