{ "@context": "https://schema.org", "@id": "https://aggr.aymericbeaumet.com/items/philschmid-de/2026-09-28-credentials-api-for-gemini-managed-agents/#webpage", "@type": [ "WebPage", "ArchiveComponent" ], "articleBody": "We recently shipped the [Credentials API](https://aistudio.google.com/docs/agent-credentials) for [Managed Agents](https://aistudio.google.com/docs/agents) ([`antigravity-preview-09-2026`](https://aistudio.google.com/docs/antigravity-agent)). It lets your agent authenticate with external services like GitHub, Notion, or the Gemini API without putting raw secrets inside the [Linux sandbox](https://aistudio.google.com/docs/agent-environment).\n\n![Credentials API end-to-end flow](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_flow.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_flow_dark.png)\n\nIf you pass an API key as a normal environment variable, any dependency or script inside the sandbox can read `os.environ` and leak it. With the Credentials API, the secret stays on the server and is injected on the wire by the egress proxy.\n\n## How it works\n\n### 1\\. Store the secret once\n\nRegister a credential with [`credentials.create()`](https://aistudio.google.com/docs/agent-credentials#create-a-credential). Secrets are write-only and encrypted at rest; API responses only return metadata (`id`, `type`, `status`, timestamps).\n\n![Step 1: Store the secret once](https://www.philschmid.de/static/blog/managed-agents-credentials/step1_store_once.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/step1_store_once_dark.png)\n\nThere are [3 credential types](https://aistudio.google.com/docs/agent-credentials#credential-types):\n\n- **[`bearer_token`](https://aistudio.google.com/docs/agent-credentials#bearer-token)**: Static tokens and API keys injected as HTTP headers (`Authorization: Bearer ` by default, or custom `header_name` and `prefix`).\n- **[`oauth2`](https://aistudio.google.com/docs/agent-credentials#oauth2)**: Refresh tokens (`client_id`, `client_secret`, `refresh_token`, `token_url`). Gemini exchanges and refreshes access tokens automatically before expiry.\n- **[`environment_variable`](https://aistudio.google.com/docs/agent-credentials#environment-variable)**: For CLIs and SDKs that read secrets from the process environment. The container receives a placeholder (`__GEMINI_CRED___`), and the egress proxy swaps in the real value only for requests to `trusted_domains`.\n\n### 2\\. Reference it by ID\n\nPass the credential `id` when defining a reusable agent with [`agents.create()`](https://aistudio.google.com/docs/custom-agents#create-a-managed-agent) (or per run in [`interactions.create()`](https://aistudio.google.com/docs/interactions)) on a remote [`mcp_server`](https://aistudio.google.com/docs/agent-credentials#use-credentials-with-mcp-servers) tool, a domain in [`network.allowlist`](https://aistudio.google.com/docs/agent-credentials#use-credentials-in-the-network-allowlist), or a variable in [`base_environment.env`](https://aistudio.google.com/docs/agent-credentials#use-credentials-as-environment-variables).\n\n![Step 2: Reference it by ID](https://www.philschmid.de/static/blog/managed-agents-credentials/step2_reference_by_id.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/step2_reference_by_id_dark.png)\n\n### 3\\. Injected on the wire\n\nWhen the agent calls an [MCP tool](https://aistudio.google.com/docs/antigravity-agent#mcp-servers) or makes an outbound HTTP request from the [sandbox](https://aistudio.google.com/docs/agent-environment#network-configuration), the egress proxy checks the target domain and injects the real credential on the wire.\n\n![Step 3: Injected on the wire](https://www.philschmid.de/static/blog/managed-agents-credentials/step3_injected_on_wire.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/step3_injected_on_wire_dark.png)\n\n## Example Reviewing and smoke-testing GitHub PRs\n\nHere is a practical examples on a reusable [custom agent](https://aistudio.google.com/docs/custom-agents) that manages [`google-gemini/cookbook`](https://github.com/google-gemini/cookbook) via the Github MCP server and can make securte Gemini API calls. The `GEMINI_API_KEY` is bound as a credential, untrusted code in the sandbox can call `generativelanguage.googleapis.com` without ever seeing the real API key.\n\n![Architecture diagram: GitHub MCP bearer_token plus sandbox GEMINI_API_KEY environment_variable](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_mcp_allowlist_architecture.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_mcp_allowlist_architecture_dark.png)\n\n### Create a read-only GitHub token\n\n1. Open [GitHub Fine-grained Personal Access Tokens](https://github.com/settings/personal-access-tokens) and click **Generate new token**.\n2. Scope **Repository access** to your target repositories and set **Pull requests** and **Contents** permissions to *Read-only*.\n3. Export `GITHUB_PAT` and [`GEMINI_API_KEY`](https://aistudio.google.com/docs/interactions/api-key) locally.\n\n### Run the agent\n\nInstall the SDK (`bun add @google/genai`) and run:\n\nTypeScript\n\n```typescript\nimport { GoogleGenAI } from \"@google/genai\";\n \nconst ai = new GoogleGenAI({});\n \n// 1. Store credentials once\nconst github = await ai.credentials.create({\n id: \"github-mcp\",\n type: \"bearer_token\",\n token: process.env.GITHUB_PAT!,\n});\n \nconst geminiKey = await ai.credentials.create({\n id: \"gemini-key\",\n type: \"environment_variable\",\n value: process.env.GEMINI_API_KEY!,\n injection_location: [\"header\", \"query\"],\n trusted_domains: [\"generativelanguage.googleapis.com\"],\n});\n \n// 2. Define a reusable agent wired to both credentials\nconst agent = await ai.agents.create({\n id: \"cookbook-pr-reviewer\",\n base_agent: \"antigravity-preview-09-2026\",\n system_instruction:\n \"You are a maintainer for google-gemini/cookbook. Use the github tools to inspect pull requests, and use the sandbox to smoke-test Gemini API snippets and draft release notes.\",\n tools: [\n { type: \"code_execution\" },\n {\n type: \"mcp_server\",\n name: \"github\",\n url: \"https://api.githubcopilot.com/mcp/\",\n credential: github.id,\n },\n ],\n base_environment: {\n type: \"remote\",\n env: {\n GEMINI_API_KEY: { credential: geminiKey.id },\n },\n },\n});\n \n// 3. Run the agent\nconst interaction = await ai.interactions.create(\n {\n agent: agent.id,\n environment: \"remote\",\n input:\n \"Draft a release note for the 3 most recently merged PRs in google-gemini/cookbook, and run a live smoke test against gemini-3.8-flash in the sandbox to verify the code snippet works.\",\n },\n { timeout: 300000 },\n);\n \nconsole.log(interaction.output_text);\n```\n\nOutput:\n\nMarkdown\n\n```markdown\n# Release Notes: `google-gemini/cookbook`\n \n### 1. [PR #1347](https://github.com/google-gemini/cookbook/pull/1347) - Zero-Cloud Local Hybrid RAG Recipe with SQLite FTS5 & Gemini\n- **Author:** @Cagrik34 | **Merged At:** 2026-09-28 10:49:52 UTC\n- **Summary:** Combines SQLite FTS5 (`unicode61`) BM25 search with `text-embedding-004` dense vectors and Reciprocal Rank Fusion (RRF, k=60) in `examples/Zero_Cloud_Hybrid_RAG_SQLite_FTS5_Gemini.ipynb`.\n \n### 2. [PR #1383](https://github.com/google-gemini/cookbook/pull/1383) - Fix `musicGenerationConfig` Schema in Lyria RealTime Notebook\n- **Author:** @kkorpal | **Merged At:** 2026-09-28 10:29:00 UTC\n- **Summary:** Updates `music_generation_config` to `musicGenerationConfig` and flattens the payload in `quickstarts/Get_started_LyriaRealTime.ipynb`.\n \n### 3. [PR #1384](https://github.com/google-gemini/cookbook/pull/1384) - Fix HTTP 400 BadRequest via File API in Prompting Notebook\n- **Author:** @kkorpal | **Merged At:** 2026-09-25 12:29:48 UTC\n- **Summary:** Switches multimodal image upload in `quickstarts/Prompting.ipynb` to `client.files.upload`.\n```\n\nWhat happens during the run:\n\n1. **GitHub MCP (`github-mcp`)**: Connects to `api.githubcopilot.com/mcp/` and calls `github:list_pull_requests` and `github:pull_request_read` to inspect the latest merged PRs (`#1347`, `#1383`, `#1384`).\n2. **Sandbox execution (`gemini-key`)**: Inside the container, `$GEMINI_API_KEY` is `__GEMINI_CRED_gemini-key__`. When the smoke test calls `generativelanguage.googleapis.com`, the egress proxy swaps the placeholder for the real key on the wire.\n3. **Domain restriction**: Any request carrying `__GEMINI_CRED_gemini-key__` to a domain outside `trusted_domains` is blocked (`403`).\n\n### Rotate or delete credentials\n\n[Update a credential](https://aistudio.google.com/docs/agent-credentials#rotate-a-credential) by ID to rotate its secret without changing your agent definition, or [delete it](https://aistudio.google.com/docs/agent-credentials#delete-a-credential) when it is no longer needed:\n\nTypeScript\n\n```typescript\nawait ai.credentials.update(\"github-mcp\", {\n type: \"bearer_token\",\n token: process.env.GITHUB_PAT_NEW!,\n});\n \nawait ai.credentials.delete(\"github-mcp\");\nawait ai.credentials.delete(\"gemini-key\");\n```\n\nSee the [Credentials API docs](https://aistudio.google.com/docs/agent-credentials), [Custom Agents guide](https://aistudio.google.com/docs/custom-agents), and [Managed Agents Quickstart](https://aistudio.google.com/docs/managed-agents-quickstart) for full details.\n\nThanks for reading! If you have any questions or feedback, please let me know on [Twitter](https://twitter.com/_philschmid) or [LinkedIn](https://www.linkedin.com/in/philipp-schmid-a6a2bb196/).\n", "authors": [], "captured_at": "2026-09-28T15:21:52.698000543+00:00", "category": "programming", "content_html": "

We recently shipped the Credentials API for Managed Agents (antigravity-preview-09-2026). It lets your agent authenticate with external services like GitHub, Notion, or the Gemini API without putting raw secrets inside the Linux sandbox.

\n

\"Credentials\"\"

\n

If you pass an API key as a normal environment variable, any dependency or script inside the sandbox can read os.environ and leak it. With the Credentials API, the secret stays on the server and is injected on the wire by the egress proxy.

\n

How it works

\n

1. Store the secret once

\n

Register a credential with credentials.create(). Secrets are write-only and encrypted at rest; API responses only return metadata (id, type, status, timestamps).

\n

\"Step\"\"

\n

There are 3 credential types:

\n\n

2. Reference it by ID

\n

Pass the credential id when defining a reusable agent with agents.create() (or per run in interactions.create()) on a remote mcp_server tool, a domain in network.allowlist, or a variable in base_environment.env.

\n

\"Step\"\"

\n

3. Injected on the wire

\n

When the agent calls an MCP tool or makes an outbound HTTP request from the sandbox, the egress proxy checks the target domain and injects the real credential on the wire.

\n

\"Step\"\"

\n

Example Reviewing and smoke-testing GitHub PRs

\n

Here is a practical examples on a reusable custom agent that manages google-gemini/cookbook via the Github MCP server and can make securte Gemini API calls. The GEMINI_API_KEY is bound as a credential, untrusted code in the sandbox can call generativelanguage.googleapis.com without ever seeing the real API key.

\n

\"Architecture\"\"

\n

Create a read-only GitHub token

\n
    \n
  1. Open GitHub Fine-grained Personal Access Tokens and click Generate new token.
    2. \n
  2. Scope Repository access to your target repositories and set Pull requests and Contents permissions to Read-only.
    3. \n
  3. Export GITHUB_PAT and GEMINI_API_KEY locally.
    4. \n
\n

Run the agent

\n

Install the SDK (bun add @google/genai) and run:

\n

TypeScript

\n
import { GoogleGenAI } from "@google/genai";\n \nconst ai = new GoogleGenAI({});\n \n// 1. Store credentials once\nconst github = await ai.credentials.create({\n  id: "github-mcp",\n  type: "bearer_token",\n  token: process.env.GITHUB_PAT!,\n});\n \nconst geminiKey = await ai.credentials.create({\n  id: "gemini-key",\n  type: "environment_variable",\n  value: process.env.GEMINI_API_KEY!,\n  injection_location: ["header", "query"],\n  trusted_domains: ["generativelanguage.googleapis.com"],\n});\n \n// 2. Define a reusable agent wired to both credentials\nconst agent = await ai.agents.create({\n  id: "cookbook-pr-reviewer",\n  base_agent: "antigravity-preview-09-2026",\n  system_instruction:\n    "You are a maintainer for google-gemini/cookbook. Use the github tools to inspect pull requests, and use the sandbox to smoke-test Gemini API snippets and draft release notes.",\n  tools: [\n    { type: "code_execution" },\n    {\n      type: "mcp_server",\n      name: "github",\n      url: "https://api.githubcopilot.com/mcp/",\n      credential: github.id,\n    },\n  ],\n  base_environment: {\n    type: "remote",\n    env: {\n      GEMINI_API_KEY: { credential: geminiKey.id },\n    },\n  },\n});\n \n// 3. Run the agent\nconst interaction = await ai.interactions.create(\n  {\n    agent: agent.id,\n    environment: "remote",\n    input:\n      "Draft a release note for the 3 most recently merged PRs in google-gemini/cookbook, and run a live smoke test against gemini-3.8-flash in the sandbox to verify the code snippet works.",\n  },\n  { timeout: 300000 },\n);\n \nconsole.log(interaction.output_text);\n
\n

Output:

\n

Markdown

\n
# Release Notes: `google-gemini/cookbook`\n \n### 1. [PR #1347](https://github.com/google-gemini/cookbook/pull/1347) - Zero-Cloud Local Hybrid RAG Recipe with SQLite FTS5 & Gemini\n- **Author:** @Cagrik34 | **Merged At:** 2026-09-28 10:49:52 UTC\n- **Summary:** Combines SQLite FTS5 (`unicode61`) BM25 search with `text-embedding-004` dense vectors and Reciprocal Rank Fusion (RRF, k=60) in `examples/Zero_Cloud_Hybrid_RAG_SQLite_FTS5_Gemini.ipynb`.\n \n### 2. [PR #1383](https://github.com/google-gemini/cookbook/pull/1383) - Fix `musicGenerationConfig` Schema in Lyria RealTime Notebook\n- **Author:** @kkorpal | **Merged At:** 2026-09-28 10:29:00 UTC\n- **Summary:** Updates `music_generation_config` to `musicGenerationConfig` and flattens the payload in `quickstarts/Get_started_LyriaRealTime.ipynb`.\n \n### 3. [PR #1384](https://github.com/google-gemini/cookbook/pull/1384) - Fix HTTP 400 BadRequest via File API in Prompting Notebook\n- **Author:** @kkorpal | **Merged At:** 2026-09-25 12:29:48 UTC\n- **Summary:** Switches multimodal image upload in `quickstarts/Prompting.ipynb` to `client.files.upload`.\n
\n

What happens during the run:

\n
    \n
  1. GitHub MCP (github-mcp): Connects to api.githubcopilot.com/mcp/ and calls github:list_pull_requests and github:pull_request_read to inspect the latest merged PRs (#1347, #1383, #1384).
    2. \n
  2. Sandbox execution (gemini-key): Inside the container, $GEMINI_API_KEY is __GEMINI_CRED_gemini-key__. When the smoke test calls generativelanguage.googleapis.com, the egress proxy swaps the placeholder for the real key on the wire.
    3. \n
  3. Domain restriction: Any request carrying __GEMINI_CRED_gemini-key__ to a domain outside trusted_domains is blocked (403).
    4. \n
\n

Rotate or delete credentials

\n

Update a credential by ID to rotate its secret without changing your agent definition, or delete it when it is no longer needed:

\n

TypeScript

\n
await ai.credentials.update("github-mcp", {\n  type: "bearer_token",\n  token: process.env.GITHUB_PAT_NEW!,\n});\n \nawait ai.credentials.delete("github-mcp");\nawait ai.credentials.delete("gemini-key");\n
\n

See the Credentials API docs, Custom Agents guide, and Managed Agents Quickstart for full details.

\n

Thanks for reading! If you have any questions or feedback, please let me know on Twitter or LinkedIn.

\n", "content_markdown": "We recently shipped the [Credentials API](https://aistudio.google.com/docs/agent-credentials) for [Managed Agents](https://aistudio.google.com/docs/agents) ([`antigravity-preview-09-2026`](https://aistudio.google.com/docs/antigravity-agent)). It lets your agent authenticate with external services like GitHub, Notion, or the Gemini API without putting raw secrets inside the [Linux sandbox](https://aistudio.google.com/docs/agent-environment).\n\n![Credentials API end-to-end flow](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_flow.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_flow_dark.png)\n\nIf you pass an API key as a normal environment variable, any dependency or script inside the sandbox can read `os.environ` and leak it. With the Credentials API, the secret stays on the server and is injected on the wire by the egress proxy.\n\n## How it works\n\n### 1\\. Store the secret once\n\nRegister a credential with [`credentials.create()`](https://aistudio.google.com/docs/agent-credentials#create-a-credential). Secrets are write-only and encrypted at rest; API responses only return metadata (`id`, `type`, `status`, timestamps).\n\n![Step 1: Store the secret once](https://www.philschmid.de/static/blog/managed-agents-credentials/step1_store_once.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/step1_store_once_dark.png)\n\nThere are [3 credential types](https://aistudio.google.com/docs/agent-credentials#credential-types):\n\n- **[`bearer_token`](https://aistudio.google.com/docs/agent-credentials#bearer-token)**: Static tokens and API keys injected as HTTP headers (`Authorization: Bearer ` by default, or custom `header_name` and `prefix`).\n- **[`oauth2`](https://aistudio.google.com/docs/agent-credentials#oauth2)**: Refresh tokens (`client_id`, `client_secret`, `refresh_token`, `token_url`). Gemini exchanges and refreshes access tokens automatically before expiry.\n- **[`environment_variable`](https://aistudio.google.com/docs/agent-credentials#environment-variable)**: For CLIs and SDKs that read secrets from the process environment. The container receives a placeholder (`__GEMINI_CRED___`), and the egress proxy swaps in the real value only for requests to `trusted_domains`.\n\n### 2\\. Reference it by ID\n\nPass the credential `id` when defining a reusable agent with [`agents.create()`](https://aistudio.google.com/docs/custom-agents#create-a-managed-agent) (or per run in [`interactions.create()`](https://aistudio.google.com/docs/interactions)) on a remote [`mcp_server`](https://aistudio.google.com/docs/agent-credentials#use-credentials-with-mcp-servers) tool, a domain in [`network.allowlist`](https://aistudio.google.com/docs/agent-credentials#use-credentials-in-the-network-allowlist), or a variable in [`base_environment.env`](https://aistudio.google.com/docs/agent-credentials#use-credentials-as-environment-variables).\n\n![Step 2: Reference it by ID](https://www.philschmid.de/static/blog/managed-agents-credentials/step2_reference_by_id.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/step2_reference_by_id_dark.png)\n\n### 3\\. Injected on the wire\n\nWhen the agent calls an [MCP tool](https://aistudio.google.com/docs/antigravity-agent#mcp-servers) or makes an outbound HTTP request from the [sandbox](https://aistudio.google.com/docs/agent-environment#network-configuration), the egress proxy checks the target domain and injects the real credential on the wire.\n\n![Step 3: Injected on the wire](https://www.philschmid.de/static/blog/managed-agents-credentials/step3_injected_on_wire.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/step3_injected_on_wire_dark.png)\n\n## Example Reviewing and smoke-testing GitHub PRs\n\nHere is a practical examples on a reusable [custom agent](https://aistudio.google.com/docs/custom-agents) that manages [`google-gemini/cookbook`](https://github.com/google-gemini/cookbook) via the Github MCP server and can make securte Gemini API calls. The `GEMINI_API_KEY` is bound as a credential, untrusted code in the sandbox can call `generativelanguage.googleapis.com` without ever seeing the real API key.\n\n![Architecture diagram: GitHub MCP bearer_token plus sandbox GEMINI_API_KEY environment_variable](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_mcp_allowlist_architecture.png)![](https://www.philschmid.de/static/blog/managed-agents-credentials/credentials_mcp_allowlist_architecture_dark.png)\n\n### Create a read-only GitHub token\n\n1. Open [GitHub Fine-grained Personal Access Tokens](https://github.com/settings/personal-access-tokens) and click **Generate new token**.\n2. Scope **Repository access** to your target repositories and set **Pull requests** and **Contents** permissions to *Read-only*.\n3. Export `GITHUB_PAT` and [`GEMINI_API_KEY`](https://aistudio.google.com/docs/interactions/api-key) locally.\n\n### Run the agent\n\nInstall the SDK (`bun add @google/genai`) and run:\n\nTypeScript\n\n```typescript\nimport { GoogleGenAI } from \"@google/genai\";\n \nconst ai = new GoogleGenAI({});\n \n// 1. Store credentials once\nconst github = await ai.credentials.create({\n id: \"github-mcp\",\n type: \"bearer_token\",\n token: process.env.GITHUB_PAT!,\n});\n \nconst geminiKey = await ai.credentials.create({\n id: \"gemini-key\",\n type: \"environment_variable\",\n value: process.env.GEMINI_API_KEY!,\n injection_location: [\"header\", \"query\"],\n trusted_domains: [\"generativelanguage.googleapis.com\"],\n});\n \n// 2. Define a reusable agent wired to both credentials\nconst agent = await ai.agents.create({\n id: \"cookbook-pr-reviewer\",\n base_agent: \"antigravity-preview-09-2026\",\n system_instruction:\n \"You are a maintainer for google-gemini/cookbook. Use the github tools to inspect pull requests, and use the sandbox to smoke-test Gemini API snippets and draft release notes.\",\n tools: [\n { type: \"code_execution\" },\n {\n type: \"mcp_server\",\n name: \"github\",\n url: \"https://api.githubcopilot.com/mcp/\",\n credential: github.id,\n },\n ],\n base_environment: {\n type: \"remote\",\n env: {\n GEMINI_API_KEY: { credential: geminiKey.id },\n },\n },\n});\n \n// 3. Run the agent\nconst interaction = await ai.interactions.create(\n {\n agent: agent.id,\n environment: \"remote\",\n input:\n \"Draft a release note for the 3 most recently merged PRs in google-gemini/cookbook, and run a live smoke test against gemini-3.8-flash in the sandbox to verify the code snippet works.\",\n },\n { timeout: 300000 },\n);\n \nconsole.log(interaction.output_text);\n```\n\nOutput:\n\nMarkdown\n\n```markdown\n# Release Notes: `google-gemini/cookbook`\n \n### 1. [PR #1347](https://github.com/google-gemini/cookbook/pull/1347) - Zero-Cloud Local Hybrid RAG Recipe with SQLite FTS5 & Gemini\n- **Author:** @Cagrik34 | **Merged At:** 2026-09-28 10:49:52 UTC\n- **Summary:** Combines SQLite FTS5 (`unicode61`) BM25 search with `text-embedding-004` dense vectors and Reciprocal Rank Fusion (RRF, k=60) in `examples/Zero_Cloud_Hybrid_RAG_SQLite_FTS5_Gemini.ipynb`.\n \n### 2. [PR #1383](https://github.com/google-gemini/cookbook/pull/1383) - Fix `musicGenerationConfig` Schema in Lyria RealTime Notebook\n- **Author:** @kkorpal | **Merged At:** 2026-09-28 10:29:00 UTC\n- **Summary:** Updates `music_generation_config` to `musicGenerationConfig` and flattens the payload in `quickstarts/Get_started_LyriaRealTime.ipynb`.\n \n### 3. [PR #1384](https://github.com/google-gemini/cookbook/pull/1384) - Fix HTTP 400 BadRequest via File API in Prompting Notebook\n- **Author:** @kkorpal | **Merged At:** 2026-09-25 12:29:48 UTC\n- **Summary:** Switches multimodal image upload in `quickstarts/Prompting.ipynb` to `client.files.upload`.\n```\n\nWhat happens during the run:\n\n1. **GitHub MCP (`github-mcp`)**: Connects to `api.githubcopilot.com/mcp/` and calls `github:list_pull_requests` and `github:pull_request_read` to inspect the latest merged PRs (`#1347`, `#1383`, `#1384`).\n2. **Sandbox execution (`gemini-key`)**: Inside the container, `$GEMINI_API_KEY` is `__GEMINI_CRED_gemini-key__`. When the smoke test calls `generativelanguage.googleapis.com`, the egress proxy swaps the placeholder for the real key on the wire.\n3. **Domain restriction**: Any request carrying `__GEMINI_CRED_gemini-key__` to a domain outside `trusted_domains` is blocked (`403`).\n\n### Rotate or delete credentials\n\n[Update a credential](https://aistudio.google.com/docs/agent-credentials#rotate-a-credential) by ID to rotate its secret without changing your agent definition, or [delete it](https://aistudio.google.com/docs/agent-credentials#delete-a-credential) when it is no longer needed:\n\nTypeScript\n\n```typescript\nawait ai.credentials.update(\"github-mcp\", {\n type: \"bearer_token\",\n token: process.env.GITHUB_PAT_NEW!,\n});\n \nawait ai.credentials.delete(\"github-mcp\");\nawait ai.credentials.delete(\"gemini-key\");\n```\n\nSee the [Credentials API docs](https://aistudio.google.com/docs/agent-credentials), [Custom Agents guide](https://aistudio.google.com/docs/custom-agents), and [Managed Agents Quickstart](https://aistudio.google.com/docs/managed-agents-quickstart) for full details.\n\nThanks for reading! If you have any questions or feedback, please let me know on [Twitter](https://twitter.com/_philschmid) or [LinkedIn](https://www.linkedin.com/in/philipp-schmid-a6a2bb196/).\n", "dateCreated": "2026-09-28T15:21:52.698000543+00:00", "date_created": "2026-09-28T00:00:00+00:00", "date_modified": "2026-09-28T00:00:00+00:00", "date_published": "2026-09-28T00:00:00+00:00", "description": "Store secrets once with the Credentials API, reference them by ID, and let the egress proxy inject them on the wire so they never enter the agent sandbox.", "external_url": "https://www.philschmid.de/managed-agents-credentials", "git": { "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e", "path": "items/philschmid-de/2026/09/2026-09-28-credentials-api-for-gemini-managed-agents.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/philschmid-de/2026/09/2026-09-28-credentials-api-for-gemini-managed-agents.md" }, "id": "urn:aggr:item:5248e714ed27126618dfd2cd3e23e7240c4969fa", "isBasedOn": { "@id": "https://www.philschmid.de/managed-agents-credentials" }, "mainEntity": { "@id": "https://www.philschmid.de/managed-agents-credentials", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/philschmid-de/2026-09-28-credentials-api-for-gemini-managed-agents/#webpage" }, "dateModified": "2026-09-28T00:00:00+00:00", "datePublished": "2026-09-28T00:00:00+00:00", "headline": "Credentials API for Gemini Managed Agents", "timeRequired": "PT4M", "url": "https://www.philschmid.de/managed-agents-credentials", "wordCount": 819 }, "name": "Archived snapshot: Credentials API for Gemini Managed Agents", "preview": null, "reading_minutes": 4, "replicated_at": null, "source": "philschmid-de", "source_name": "philschmid.de - RSS feed", "summary": "Store secrets once with the Credentials API, reference them by ID, and let the egress proxy inject them on the wire so they never enter the agent sandbox.", "tags": [], "temporalCoverage": "2026-09-28T15:21:52.698000543+00:00", "title": "Credentials API for Gemini Managed Agents", "url": "https://aggr.aymericbeaumet.com/items/philschmid-de/2026-09-28-credentials-api-for-gemini-managed-agents/", "word_count": 819 }