credential-proxy

Use when a workload (agent, sandbox, container, CI job) must call an authenticated upstream (LLM/provider/cloud API) but should not hold the credential itself. Keep the secret in a proxy that injects it, so a compromised workload cannot exfiltrate the key.