How Do I Keep an API Key Out of an Agent's Sandbox?

your machine                                     sandbox (the agent)
------------------------------------------       ---------------------------------
keyproxy.py on 127.0.0.1:7777                    PROXY_URL=http://127.0.0.1:7777
  holds UPSTREAM_API_KEY                         PROXY_TOKEN=<revocable token>
  checks the proxy token     <-- sbx forward --reverse --local 7777 --
  allows a few paths
  adds "Authorization: Bearer <real key>"
  logs every call to calls.log
        |
        v
  https://httpbin.org  (stands in for the real API)

#!/usr/bin/env python3
"""keyproxy: holds the real API key, injects it, logs every call.
Run it on your machine or server, never in the sandbox."""
import json, os, sys, time, urllib.error, urllib.request
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

UPSTREAM = "https://httpbin.org"             # the API you're protecting
ALLOW = ("/bearer", "/headers", "/anything/") # paths the agent may call
REAL_KEY = os.environ["UPSTREAM_API_KEY"]     # read once; never sent to the sandbox
TOKENS = "tokens.json"                        # {"<proxy token>": "<label>"}; edit to revoke
LOG = open("calls.log", "a", buffering=1)

class Proxy(BaseHTTPRequestHandler):
    def handle_one(self):
        t0 = time.time()
        sent = self.headers.get("Authorization", "").removeprefix("Bearer ")
        tokens = json.load(open(TOKENS))      # re-read on every call: revoking is instant
        who = tokens.get(sent)
        if not who:
            return self.reply(401, b'{"error":"unknown or revoked proxy token"}\n', "-", t0)
        if not self.path.startswith(ALLOW):
            return self.reply(403, b'{"error":"path not allowed"}\n', who, t0)
        n = int(self.headers.get("Content-Length") or 0)
        req = urllib.request.Request(UPSTREAM + self.path, data=self.rfile.read(n) if n else None,
                                     method=self.command)
        req.add_header("Authorization", "Bearer " + REAL_KEY)  # the only place the key is used
        if self.headers.get("Content-Type"):
            req.add_header("Content-Type", self.headers["Content-Type"])
        try:
            with urllib.request.urlopen(req, timeout=30) as r:
                status, body = r.status, r.read()
        except urllib.error.HTTPError as e:
            status, body = e.code, e.read()
        body = body.replace(REAL_KEY.encode(), b"[key redacted by proxy]")  # in case the API echoes it
        self.reply(status, body, who, t0)

    def reply(self, status, body, who, t0):
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
        LOG.write(json.dumps({"t": time.strftime("%H:%M:%S", time.gmtime()), "token": who,
                              "method": self.command, "path": self.path, "status": status,
                              "ms": int((time.time() - t0) * 1000)}) + "\n")

    do_GET = do_POST = handle_one
    def log_message(self, *a): pass

ThreadingHTTPServer(("127.0.0.1", 7777), Proxy).serve_forever()

umask 077
export UPSTREAM_API_KEY='sk-demo-…'          # your real key; ours was a random fake
PROXY_TOKEN=$(openssl rand -hex 16)
printf '{"%s": "agent-run-1"}\n' "$PROXY_TOKEN" > tokens.json
python3 keyproxy.py &

sbx new --name keyproxy-demo --type small --no-env \
  -e PROXY_URL=http://127.0.0.1:7777 -e PROXY_TOKEN="$PROXY_TOKEN"
sbx forward sb_jc43u5mqr6 --reverse --local 7777      # leave this running

{"event":"forwarding","id":"sb_jc43u5mqr6","reverse":true,"local":7777,"remote":7777,"bind":"127.0.0.1"}

sbx exec sb_jc43u5mqr6 'curl -s -o /dev/null -w "%{http_code}\n" https://httpbin.org/bearer'

401

sbx exec sb_jc43u5mqr6 'curl -s -H "Authorization: Bearer $PROXY_TOKEN" $PROXY_URL/bearer'
sbx exec sb_jc43u5mqr6 'curl -s -H "Authorization: Bearer $PROXY_TOKEN" $PROXY_URL/headers'

{
  "authenticated": true,
  "token": "[key redacted by proxy]"
}
{
  "headers": {
    "Accept-Encoding": "identity",
    "Authorization": "Bearer [key redacted by proxy]",
    "Host": "httpbin.org",
    "User-Agent": "Python-urllib/3.14",
    …
  }
}

sbx exec sb_jc43u5mqr6 'curl -s -w "%{http_code}\n" -H "Authorization: Bearer $PROXY_TOKEN" $PROXY_URL/get'
sbx exec sb_jc43u5mqr6 'curl -s -w "%{http_code}\n" $PROXY_URL/bearer'

{"error":"path not allowed"}
403
{"error":"unknown or revoked proxy token"}
401

import json, os, urllib.request

def call_api(path):
    """The agent's tool: it knows only the proxy URL and its proxy token."""
    req = urllib.request.Request(os.environ["PROXY_URL"] + path,
        headers={"Authorization": "Bearer " + os.environ["PROXY_TOKEN"]})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.load(r)

print(call_api("/anything/search?q=sandbox")["args"])

{'q': 'sandbox'}

sbx exec sb_jc43u5mqr6 --timeout 600 '
  sudo grep -rIl -E "sk-dem[o]-" / --exclude-dir=proc --exclude-dir=sys --exclude-dir=dev 2>/dev/null | wc -l
  sudo sh -c "cat /proc/[0-9]*/environ" 2>/dev/null | tr "\0" "\n" | grep -cE "sk-dem[o]-"'
sbx history sb_jc43u5mqr6 --limit 100 --grep sk-demo

0
0
{"ok":true,"type":"command.list","commands":[],"nextCursor":null}