If you're wiring an autonomous agent up to real APIs — Stripe, Supabase, GitHub, your own backend — there's a design decision most stacks get wrong, and it's the same one that turns "the agent did something weird" into "the agent moved money." The root problem: the credential is the capability An API key is a bearer token. Whoever holds the bytes can do everything the key permits, for as long as the key lives, with no per-call limit and usually no per-call record. When you paste that key into an agent's environment, you've handed a non-deterministic process the full blast radius of that key in one move. A prompt injection, a logging mistake, a retry loop — any of them now operates with your production credentials. Rotating after a leak means rotating everywhere the key was ever embedded . And a leaked key is indistinguishable from a legitimate caller until you notice the bill.…