Gemini Managed Agents Credentials API keeps secrets out of the sandbox

The Credentials API for Gemini Managed Agents lets an agent authenticate with services like GitHub and the Gemini API without placing raw secrets in the Linux sandbox.

Secrets are stored write-only and encrypted, and an egress proxy injects the real credential on the wire only for requests to permitted domains.

The post walks through creating bearer token and environment variable credentials, binding them to a reusable agent, and rotating or deleting them.