Credentials System Deep Dive

How credential resolution works — three-tier hierarchy, Secure Vault, BYOK, and API cost tracking.

Written By Philippe

Last updated 30 days ago

Credentials System Deep Dive

indie.money's credential system has three tiers. Understanding how they interact helps both Builders and Producers configure agents correctly.

Three-Tier Resolution Chain

When an agent runs, credentials are resolved in this order:

  • Your own keys (Producer/BYOK) — When you provide your own API keys, those are used first. You control your API usage and rate limits directly.
  • Builder-provided — Builder pre-configured credentials are used when you haven't provided your own.
  • Platform-provided — indie.money provides built-in credentials for certain services. Fallback when the above are unavailable.

Secure Vault

All credentials are stored in the Secure Vault. Key properties:

  • Encrypted at rest and in transit
  • Decrypted only at execution time
  • Supports API key, OAuth 2.0, and Basic auth
  • OAuth tokens are refreshed automatically

BYOK (Bring Your Own Keys)

Producers who provide their own API keys are using BYOK mode. This is the most flexible option — you control your API usage and rate limits directly.

API Cost Tracking

Every provider has a cost model that determines how its API costs are tracked:

Cost ModelHow It WorksExamples
TrackedActual cost parsed from API responseOpenRouter, OpenAI
FixedDeclared per-call cost from registry ($0.00 when unknown)Twilio ($0.0079), SendGrid ($0.001); DeepL, Google Translate, Telegram, Slack, Discord ($0.00)

When a Builder pre-configures cost-bearing credentials (tracked, fixed, or variable) with an Who Pays for AI Usage?, the system:

  • Records the API cost for each call (actual from response, or declared from registry)
  • Enforces the cost ceiling across all cost types, so a run can never exceed the maximum shown before it starts
  • Bills the Producer according to the agent's pricing mode, never above that maximum
  • Returns anything held but unused within minutes

Messaging APIs without a registered per-call cost (Telegram, Slack, Discord) have a $0.00 declared cost and produce no charge.

Credential Isolation

Credentials are scoped per agent. A Producer's credentials for Agent A cannot be accessed by or mixed with Agent B — even if both agents use the same external service.

Security Audit Trail

All credential access is logged. Builders cannot see Producers' credential values.