Your AI agents never hold a provider key.

Base URL http://127.0.0.1:8070/v1/agent/<agent>/proxy/<target> · key OWE_TOKEN_…

1. 1

   Agent token

   401

   The agent sends its placeholder in Authorization: Bearer. A missing or wrong token stops here.

2. 2

   Target allowlist

   403 egress_blocked

   The target in the URL must be one of the agent’s allowed_targets.

3. 3

   SSRF check

   403 ssrf_blocked

   The target’s host must resolve only to public addresses.

4. 4

   Body inspection

   403 injection_detected · data_leak_blocked

   Prompt-injection detectors and data-leak patterns run over the body, without calling a model.

5. 5

   Key from OpenBao

   → provider

   The real key is read from KV v2, set on the outgoing request, and the response streams back to the agent.

• Keys injected from OpenBao or Vault

  Agents carry an OWE_TOKEN_… placeholder. After the checks, the gateway logs in with AppRole, reads the key from KV v2 (cached for 5 minutes) and sets it on the outgoing request only.

• Per-agent allowlist

  Each agent lists the targets it may reach in allowed_targets. Any other configured target gets 403 egress_blocked before the body is read.

• Data-leak prevention

  With block_dlp, a body carrying a Luhn-valid card number, a PEM private key, an AWS access key ID, an OpenAI-style sk- key or a GitHub token gets 403 data_leak_blocked.

• SSRF protection

  Loopback, RFC 1918, CGNAT, link-local (including 169.254.169.254), multicast, reserved and their IPv6 equivalents are refused with 403 ssrf_blocked.

• No redirects followed

  An upstream 3xx goes back to the agent as is, so the injected key never follows a redirect to a host outside the allowlist.

• Whole bodies or nothing

  Inline base64 images, audio and video (data: URIs and the "data" fields of OpenAI, Gemini and Anthropic) are not inspected text. The rest must fit the 1 MiB window or the request gets 413; nothing is forwarded uninspected or cut. Bodies are capped at 8 MiB.

1. 1

   Run the container on loopback

   The image listens on 0.0.0.0:8070 inside the container. Publish it on 127.0.0.1 or a private network only.

   docker

   docker run -d --name openwaf-egress -p 127.0.0.1:8070:8070 \
     -v "$PWD/config.json:/app/config.json:ro" \
     ghcr.io/openwaf-dev/egress:0.1.1

2. 2

   Point the SDK at the gateway

   Any OpenAI-compatible SDK works: change the base URL and give it the placeholder token.

   agent.ts

   import OpenAI from "openai";
   
   const client = new OpenAI({
     baseURL: "http://127.0.0.1:8070/v1/agent/my-support-agent/proxy/openrouter",
     // placeholder; the real key never reaches the agent
     apiKey: "OWE_TOKEN_SUPPORT_AGENT",
   });

Next: the quickstart (OpenBao secret, configuration and a first request) and every configuration field.