Keep credentials out of your sandboxes
Keep raw keys out of reach
Code in the sandbox never sees a credential's value, so a prompt-injected agent has no key to leak.
Scope each credential to a host
Render adds the credential only to requests sent to that host, like api.openai.com.
Set credentials once per group
Sandboxes in a group inherit its credentials, so you don't pass secrets in each time you create one.
Match how each API authenticates
Put each credential in a header, cookie, query parameter, or basic auth, formatted the way the API expects.