How to let AI agents act on behalf of users without handing them access tokens

Agent-based systems increase the risk of OAuth credential exposure because they process untrusted content as instructions while retaining access to third-party tokens, which can surface in prompts, tool logs, error reports, memory stores, or attacker-directed requests. Narrow scopes and token rotation reduce some risk but do not eliminate the underlying problem of placing portable bearer credentials in an environment vulnerable to prompt injection. The proposed alternative, WorkOS Pipes token proxy, keeps provider tokens in a separate credential store and lets agents request approved provider actions through a proxy that injects credentials, restricts destinations to allowlisted hosts, avoids redirects, and provides distinct authorization and upstream error signals. This approach does not prevent agents from being manipulated into taking unwanted actions, nor does it remove the need to protect the WorkOS API key or establish fine-grained authorization policies, but it limits the lasting impact of a compromise by preventing attackers from extracting reusable provider tokens. The broader principle is to store credentials in the least reachable component capable of using them, treating agent runtimes as decision-making environments rather than safe locations for secrets.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.