VereskLearn

Module 8 · Safety

Lesson 8.3

Credentials

Credentials are passwords and tokens, and they must stay in the server environment, never in a prompt.

Lesson 52 of 622 min read

The problem

Why it matters

Without it

A token written in the code or pasted into a prompt can leak. It may show up in logs, chat history, or a model answer.

With it

The token is read from the environment when the tool runs. The model sees the tool name and its inputs, never the token.

How it works

  • The token is read from the environment

    Store the token in an environment variable such as SHOP_API_TOKEN. An environment variable is a named setting that the operating system gives to a running program. The code reads it at run time, so the source file holds no secret. Only that program and its children can read it.

    1. Host sets SHOP_API_TOKEN
    2. Tool code reads it
    3. Shop API call
    Where the token lives, from the host to the shop API.
    // Demo only: a real token comes from the host, not from code.process.env.SHOP_API_TOKEN = "demo-token-not-real";const token = process.env.SHOP_API_TOKEN ?? "";console.log(token === "" ? "Missing token." : "Token found.");

    Output

    Token found.

  • The tool uses the token, not the model

    The lookup function reads the variable and calls the shop API. The model only chooses the order id, such as 1042. The token never appears in the tool arguments, so the model has no way to repeat it.

    Model chooses

    • Tool name: lookup_order
    • Input: order id 1042

    Tool supplies

    • The token, from the environment
    • The shop API address
    What the model chooses, and what the tool supplies on its own.
    process.env.SHOP_API_TOKEN = "demo-token-not-real";function lookupOrder(orderId: string): string {  const token = process.env.SHOP_API_TOKEN ?? "";  const set = token !== "";  return "Order " + orderId + " shipped. Token set: " + set;}console.log(lookupOrder("1042"));

    Output

    Order 1042 shipped. Token set: true

  • What the model is told

    The text sent to the model lists lookup_order and its inputs. It never includes the token or a URL that carries a key. A prompt injection therefore cannot ask the model to reveal the token, because the model never received it.

    Sent to the modelNever sent
    Tool name and inputsThe token
    Returned status textA URL with a key in it
    What is sent to the model, and what is never sent.
    const tool = "lookup_order(orderId) returns the status.";console.log("Sent to the model:", tool);

    Output

    Sent to the model: lookup_order(orderId) returns the status.

  • Masked output in logs

    When a log must show a token, print only the first few characters. This mask keeps the first five characters and adds four stars, so the log shows demo-****. Even five characters can help an attacker, so a shorter mask is safer.

    • demo-token-not-realfull value, never logged
    • demo-****masked, safe to log
    The same token, as the full value and as a masked value.
    function mask(secret: string): string {  return secret.slice(0, 5) + "****";}console.log(mask("demo-token-not-real"));

    Output

    demo-****

  • Replacing a leaked token

    If a token shows up in a log or a chat, replace it at once. The old token then stops working, so a copy in a log is no longer useful. Check the logs and the chat history for the same value.

Full code

Read the program

See the full code

Common mistakes

What goes wrong

  • Printing the full token while debugging. Logs are copied and kept far longer than expected.
  • Passing the token as a tool argument. The model can then repeat it in an answer.
  • Committing a .env file to git. Keep it out of the repository, and set its file permissions to 600.

Use it when and skip it when

Is it the right tool?

Use it when

  • The tool calls an API that needs a key, a password, or a token.
  • Logs or chat history are kept, and a secret could appear in them.

Skip it when

  • The data is public and needs no login.
  • The value is a local test string that nothing else can reach.

Words to know

Terms in this lesson

Credential
A secret that proves who is calling, such as a password or a key.
Token
A string that grants access to an API within a set scope.
Environment variable
A named setting that the operating system gives to a running program.
Mask
Hide most of a value, and show only a few characters.
Full code