Repository Public
1# Sandbox security23> For the complete documentation index, see [llms.txt](/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.45Agent-generated code can access the files, credentials, and network available to its environment.678910## Isolate workloads1112Run workloads in isolated compute, such as virtual machines. Use separate environments for users or workloads that must not share data. Create a dedicated OpenAI project for your application or workload.1314151617## Restrict network access1819Allow outbound traffic only to approved endpoints, including the executor's [required hosts](https://developers.openai.com/api/docs/guides/agents-api/environments/self-hosted#network-access).2021Configure network access based on where each tool connection runs:2223- **Executor MCPs** connect from your environment. Allow access to the servers they need.24- **Remote MCPs** connect from OpenAI's service. Their endpoints must be reachable from that service.2526See [MCP tools](https://developers.openai.com/api/docs/guides/agents-api/tools/mcp) for connection options.2728293031## Separate credentials3233Grant your application key `api.agents.read` and `api.agents.write` for sessions, plus `api.responses.write` for inference. Add `api.vaults.read` and `api.vaults.write` to manage vaults.3435Give the executor an [environment key](https://platform.openai.com/agents?tab=environments&environment_view=keys) as `CODEX_API_KEY`. This key only permits connecting environments. It cannot authorize any other API action. See [Executor authentication](https://developers.openai.com/api/docs/guides/agents-api/environments/self-hosted#authentication) for setup.3637Agent-generated code can read the environment key. Keep your application API key outside the environment. Do not embed keys in images, source code, or logs. Rotate or revoke keys when needed.3839404142## Broker third-party access4344Keep third-party credentials outside the environment. Where possible, route requests through a credential broker. The broker injects secrets into approved outbound requests without placing them in the agent's environment.4546<picture>47 <source48 media="(max-width: 640px)"49 srcSet="/images/api/agents-api/sandbox-security-1-mobile.webp"50 width="680"51 height="1252"52 />53 <img src="https://developers.openai.com/images/api/agents-api/sandbox-security-1.webp"54 width="1400"55 height="848"56 alt="In an example you configure, sandbox tools send requests to an external proxy that adds scoped credentials for approved destinations. The restricted executor key remains readable inside the sandbox."57 loading="lazy"58 />59</picture>6061Store long-lived credentials in a secrets manager. Injecting a stored secret into the environment still exposes it to agent-generated code. Rotate credentials regularly and revoke them immediately if you suspect exposure.