Skip to main content
Session-secret agent tools are temporarily disabled while hosted credential access is being completed. Agents cannot prepare or discover Session approvals through these tools. Existing configured integrations remain available.
Session secrets are a paused prototype for letting a Roomote agent make a narrow HTTP request without receiving the credential as a tool argument. They are not a general-purpose credential vault or a replacement for integrations.

​
While the prototype is paused

  • agents cannot prepare, discover, or use Session-secret approvals;
  • do not put API keys in chat, attachments, prompts, or task environment files;
  • existing approvals remain stored and can be inspected or revoked from Session secrets in the Session header; and
  • operator-configured HTTP integrations remain available and continue to enforce their configured origins, methods, and paths.
For credential-backed agent work during the pause, ask a deployment operator to configure an HTTP integration. Use a narrow origin and path policy and a least-privilege credential.

​
Security boundary

The secure form bypasses chat and does not store credentials in browser storage. Its subtree is excluded from automatic capture and replay; server-side secret routes exclude request telemetry. Do not put credentials in labels, origins, paths or ordinary Session messages. The approved upstream receives the credential. It can misuse any privileges the credential grants, including write privileges even though this tool permits only GET and HEAD. Some upstreams also perform side effects on GET. Use a least-privilege, disposable, read-only credential and approve only a trusted origin. An upstream can disclose partial values, hashes or arbitrarily transformed data that this prototype cannot reliably recognize. Returned content is visible to the agent and may enter the transcript. This is not a universal secrecy or data-loss-prevention guarantee.