Auth Proxy Keeps Secrets Out of LangSmith Sandboxes and Constrains Agent Egress
Configure Auth Proxy to isolate agent runtimes from secrets and restrict egress, ensuring credentials stay within the sandbox.
Set up Auth Proxy for your LangSmith sandbox, define allowed egress endpoints, and verify that agent credentials are not exposed.
Summary
Agents that need to call external services must handle credentials and network access carefully, as these capabilities expose new security risks. Auth Proxy is a new component for LangSmith Sandboxes that isolates agent runtimes from secrets and constrains outbound traffic, giving teams infrastructure‑level control over how agents reach external services.
The proxy keeps credentials out of the sandbox environment, allowing only explicitly allowed egress endpoints to be accessed. It integrates with the existing sandbox runtime without requiring code changes, and provides monitoring of outbound traffic so that teams can audit agent activity. By defining allowed destinations and enforcing them at the network layer, Auth Proxy reduces the risk of credential leakage and mitigates potential attacks that could arise from compromised agents. The feature is designed to be deployed alongside existing LangSmith sandboxes, enabling secure credential management for all agent workloads.
Key changes
- Auth Proxy keeps secrets out of LangSmith Sandboxes, isolating agent runtimes from credentials.
- Constrains agent egress to explicitly allowed endpoints, providing infrastructure‑level control.
- Integrates with sandbox runtime without code changes, enabling secure credential management.
- Allows defining allowed network destinations and enforces them at the network layer.
- Provides monitoring of outbound traffic for auditing agent activity.
- Reduces risk of credential leakage and mitigates attacks from compromised agents.
- Designed to be deployed alongside existing LangSmith sandboxes.
- Enables teams to audit and control agent external service access.