Credentials

Gasket doesn't store credentials for your systems. A Gasket-run agent reaches them only through your tool endpoints, which hold their own credentials and receive a signed request only for authorized tool calls. If you run your own agent code, keep credentials there and call POST /v1/actions before using them.

• Give each tool endpoint the narrowest credentials the system allows.
• Verify Gasket-Signature on every tool request.
• Rotate the agent's signing secret from its Tools tab if it leaks.

PlannedA credential vault: store a system's credentials in Gasket and have them used only for authorized calls, so no endpoint or agent holds the secret.