Autonomous work with your credentials. Your agent never holds them.

The endpoint is an OAuth 2.1 resource server. It publishes RFC 9728 metadata, and a request without the right token gets a 401 that points to it. It accepts only an access token whose audience is the Vault endpoint (RFC 8707), on a live sign-in. No other token is accepted or passed through.

Agents see titles, types, sites, the operations granted and whether a use needs a tap. Never a password, a username, a key or a card. Cards and identities are hidden from agents entirely.

use_credential_http works on API secrets. HTTPS only, to a host and port the item allows, which a grant can only narrow. DNS is resolved once and every address must be public; TLS is checked; no proxy, no redirect, no retry. The secret is scrubbed from the reply raw, URL-encoded, base64, JSON- or HTML-escaped, hex and UTF-16; Set-Cookie is dropped.

sign_digest signs in AWS KMS with a key that cannot be exported. By default every signature asks for a tap. Every signature is recorded with its full digest and label, so a key's card shows what it signed.

A grant covers one item, one agent, named operations and hosts. You approve it with a number-matched tap, or in the console after a fresh step-up. A request lapses after 15 minutes; an agent may have five pending.

The person is the token's subject and the agent is its OAuth client. Another person's item reads exactly like an id that names nothing.

One feed shows each use with its agent, item, operation and host. Disconnect one agent, or press Stop all to end every agent's access and sign out connected browsers. Neither needs a step-up.

Revoking ends the consent, every refresh grant, every credential grant and the session behind it (RFC 7009). Refresh tokens rotate on every use; a reused one revokes the whole chain.

Every use, refusal, signature and grant writes an audit row before anything is returned. It names the host, never a value or a path.

Your plan sets how many agents each person can connect. If a plan changes, your earliest-connected agents keep working.

Page scripts only find, tag, focus, empty and click. None of them carries a value, so nothing on the page can read one from a script.

The value travels once, in DevTools Input.insertText, into the focused field, after the bridge has checked it is the right one: a password goes into a password field only, on the host the release was made for.

The bridge presses the page's own submit control straight away. If anything fails after typing, or the field is still there, it empties the password and code fields.

The DevTools endpoint is configured, never guessed, and must be 127.0.0.1, localhost or ::1, for every tab's socket too. It works with a Chrome your agent already drives over the DevTools protocol, the channel Playwright uses.

Each release is checked against the tab's real URL, https only, and against the hosts in your grant.

A value is held for one fill or one run, then every reference is dropped. Never a file, a cache, a log line, an error or a tool answer.

The command runs directly, never through a shell. The secret sits in one environment variable; names that change how programs load, such as PATH, LD_* and NODE_OPTIONS, are refused. Output is redacted with the vault's own redactor.

vaarta-credential-bridge ssh gives one command a private ssh-agent socket that signs only SSH login requests, with your KMS key. The host is declared and checked three ways; your phone shows it before you tap.