Skip to content
ReleasesGitHub

Client library patterns for Agent Proxy

Behind Agent Proxy, the only application-side integration work is placing a placeholder credential where your client library requires one. This page explains placeholder credentials, shows where the placeholder goes for the three common library types, and links the official SDK documentation for the services Aembit documents. For the integration procedure itself, see Integrate through Agent Proxy.

Understanding placeholder credentials

Section titled “Understanding placeholder credentials”

A placeholder credential is a stand-in value used only for client library initialization. Agent Proxy intercepts authentication requests and replaces placeholder values with real, dynamically generated credentials before they reach the target Server Workload: Server Workloads represent target services, APIs, databases, or applications that receive and respond to access requests from Client Workloads.Learn more. The placeholder never reaches the target service.

Any non-empty string that satisfies your library’s validation works as a placeholder, such as 'placeholder-client-secret', 'aembit-managed', or 'dummy-value-12345'.

Libraries need a placeholder because they validate that required credential fields are present during initialization, and without a value they throw errors like:

ValueError: client_secret is required

The placeholder satisfies that validation while Aembit manages the actual credential.

OAuth SDK initialization

Section titled “OAuth SDK initialization”

Most OAuth SDKs follow this initialization pattern:

from some_oauth_library import OAuthClient


# Initialize with placeholder
client = OAuthClient(
    client_id='your-client-id',
    client_secret='placeholder-client-secret',  # ← Aembit replaces
    token_url='https://oauth-provider.com/token'
)


# Acquire token - Aembit intercepts this request
token = client.get_access_token(scopes=['api.read'])


# Use the token with your service's API client
api_client.call_api(access_token=token)

The placeholder goes in the client_secret parameter, and the SDK sends the token request automatically. Aembit intercepts the POST /token request, so the SDK receives a valid access token.

API key in headers

Section titled “API key in headers”

API key libraries typically set headers:

import requests


# Aembit injects API key into Authorization header automatically
# Application code doesn't include the key at all
response = requests.get(
    'https://api.example.com/resource',
    # No Authorization header needed - Aembit adds it
)

The application code carries no API key, because Aembit injects the header transparently, and the application sees normal API responses.

Database connection

Section titled “Database connection”

Database drivers use connection parameters:

import psycopg


# Placeholders in connection string
connection = psycopg.connect(
    "host=database.example.com "
    "port=5432 "
    "dbname=mydb "
    "user=placeholder-username "  # ← Aembit replaces
    "password=placeholder-password"  # ← Aembit replaces
)


# Use connection normally
cursor = connection.cursor()
cursor.execute("SELECT * FROM users")

The placeholders go in the user and password parameters, and Aembit intercepts the connection request, so the driver receives a valid connection.

Service-specific SDK resources

Section titled “Service-specific SDK resources”

When integrating with your specific service, use these resources for SDK-specific guidance:

OAuth-based services

Section titled “OAuth-based services”

API key services

Section titled “API key services”

Database services

Section titled “Database services”

Cloud provider services

Section titled “Cloud provider services”

Next steps

Section titled “Next steps”