how should i pass some sensitive data to agent from my api server? is it safe to use job context, metadata?

you agent could make a REST call to your server to retrieve the sensitive data.