https://livekit.io logo
Join Slack
Powered by
how to pass sensitive data to agent?
# ask-ai
b
how to pass sensitive data to agent?
t
Thanks for reaching out, s. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.
Thanks — I’m responding about securely passing sensitive data to an agent. Short answer: • Store secrets (API keys, tokens, credentials) as LiveKit secrets and inject them into the agent as environment variables. • Pass per-job user data (IDs, non-secret PII) in the dispatch 
metadata
field (JSON). Access metadata from the job context inside the agent. • Avoid embedding secrets directly in code, logs, or the metadata payload. What to do (steps): 1. Create a secret in the LiveKit CLI or dashboard and set its value (the secret value is never stored in source code). 2. Configure the agent to use that secret so it’s available as an environment variable at runtime. 3. When dispatching a job, put user-specific data in the 
metadata
field of the dispatch request (JSON). The agent reads this from the job context. 4. In the agent code, read secrets from env vars and metadata from the job context; do not print secrets or include them in logs. 5. Follow data-minimization: pass only the fields the agent needs, and redact or omit unnecessary sensitive fields. If you want, tell me: • whether the data is an API key/credential (store as a secret) or per-job user data (use metadata), and • whether you need examples for the CLI, agent config, or the dispatch JSON — I’ll provide the exact snippet. Sources: Agent Builder | LiveKit docs | Agent dispatch | LiveKit docs | Job lifecycle | LiveKit docs
b
yes, maybe i want to pass some api keys or top secret things to agent worker
t
You're right to treat API keys and top-secret values carefully. Below are concrete, secure steps to store and inject those secrets into an agent worker, plus a few safety reminders. Reply with which platform (CLI or dashboard) and agent runtime you use if you want exact commands/snippets. How to securely pass API keys / top-secret values to an agent 1. Store secrets in LiveKit Secrets (do not embed in code) • Create a secret via the LiveKit dashboard or CLI. The secret value is kept out of source control and not shown in logs. 1. Inject secrets as environment variables into the agent • Configure the agent to reference the secret; at runtime the secret is exposed only as an environment variable inside the agent worker. Read it from 
process.env
(Node), 
os.Getenv
(Go), or equivalent in your runtime. 1. Pass only non-secret per-job data in 
metadata
• Use the dispatch 
metadata
JSON for user IDs or job-specific non-sensitive fields. Do NOT place secrets or raw credentials in 
metadata
. 1. Least privilege & rotation • Give the agent the minimum privileges needed for the task (use scoped API keys). Rotate keys regularly and revoke immediately if compromised. 1. Avoid logging or returning secrets • Never print secrets or include them in logs, error messages, or responses. Mask or redact any sensitive fields before logging. 1. Secure transport & storage • Ensure any transport you control (API requests to dispatch jobs, dashboard) uses TLS. Keep access to the LiveKit dashboard/CLI restricted to authorized personnel. What I can provide next • CLI or dashboard command examples to create and attach a secret to an agent. • A sample agent code snippet showing how to read the secret from env vars. • A sample dispatch JSON showing safe 
metadata
use (no secrets). Which would you like first — CLI commands, agent runtime snippet (Node/Go/Python), or the dispatch JSON example?
2 Views
Open in Slack
PreviousNext
Powered by