| name | cred-proxy |
| description | Transparent authentication proxy — injects credentials into HTTP traffic automatically |
| user-invocable | false |
cred-proxy
All outbound HTTP traffic from this environment flows through cred-proxy, a transparent authentication injection proxy. When a request matches a configured domain, the proxy automatically adds the correct credentials on the wire. You do not need to manage secrets yourself.
Rules
- Use placeholder credentials — when CLI tools or config files require explicit credentials (e.g.
gh auth login, ~/.npmrc, curl Authorization header), use placeholder or PLACEHOLDER_TOKEN. The proxy overwrites them before the request reaches the upstream server.
- Don't set auth headers manually — the proxy injects
Authorization and other auth mechanisms. Manual headers may conflict.
- Don't bypass the proxy — all HTTP traffic must flow through it for credential injection to work.
- Don't log or print credential values — even if you discover them, treat them as opaque.
Discovering Available Credentials
To check which domains have credentials configured:
GET http://any-host/__auth/credentials
Returns a JSON array of {"id", "domain", "enabled"} objects. You can filter by domain with ?domain=example.com.
Requesting New Credentials
If you need credentials for a domain that isn't configured yet:
POST http://any-host/__auth/request
Content-Type: application/json
{"domain": "api.example.com", "reason": "Need to fetch user data"}
The response includes a setup_url for the human operator and a token to poll for status:
GET http://any-host/__auth/request/{token}/status
Poll until status is "fulfilled" or "expired".
Access Rules
The proxy may enforce access rules that restrict which URL paths you can access on certain domains. If a request is blocked by an access rule, you'll receive a 403 response with "error": "access_denied". This means the domain is configured but your requested path is not permitted. You cannot override access rules — they are set by the operator.
Reference
See API-REFERENCE.md for full /__auth/* endpoint details including request/response schemas and error codes.
