Providers: Credential substitution/injection

[manstis]

I understand how a Provider is configured and Inference set.

I understand how use of https://inference.local works to proxy requests via the Gateway for credential substitution.

Is OpenShell capable of proxying all external traffic via the Gateway for credential substitution?

For example:

I have an Agent that uses an LLM requiring an API_KEY. Provider and Inference keep the credential out of the sandbox.

The Agent also needs to make use of GitHub's REST API needing a GITHUB_TOKEN credential too.

How does OpenShell handle credential injection?

I read I can create a new Provider for GitHub including it's GITHUB_TOKEN but it's less clear how the injection works.

Are there similar Gateway URLs for different Providers? e.g. https://github.local etc.

Or, does "Providers v2" make https://inference.local obsolete and the network policies defined therein automatically pass through the Gateway for credential injection?

Sorry to ask.

[johntmyers]

Please browse our documentation on how credential injection works and how it interacts with providers.

https://github.com/NVIDIA/OpenShell/blob/main/architecture/sandbox.md