developers

Secure Your AI: Stop Managing API Keys by Hand

Learn how to secure AI agents using Auth0's Token Vault and CIBA. Stop manual token management and implement secure asynchronous authorization.

Carlos Aguilar

Customer Advocate

Lily Wisecarver

Senior Product Advocate

Mar 17, 2026 • 6 min read

Building an AI agent prototype is easy; you can get a LangChain demo running in an afternoon with a hardcoded API key. But building custom auth and token management for production AI agents is a massive time sink and a security nightmare.

The most significant leap in your agent's capability comes from enabling it to actually execute tasks for your users. To build workflows that execute reliably without crashing when tokens expire, from reading a Google Calendar to drafting an email or pulling Salesforce data, your agent needs an access token.

If you want to build truly scalable and secure AI agents, you need to move beyond custom authentication logic. Here is how a dedicated identity layer handles the two hardest architectural problems in AI authorization:

  1. Token Persistence: Keeping an autonomous agent connected to third-party services (like Slack or Salesforce) without the agent needing to manage sensitive keys or refresh tokens itself.
  2. Out-of-Band Consent: Getting a human's approval for high-stakes actions when the user isn't actively in a browser session. We solve this using Client-Initiated Backchannel Authentication (CIBA), an OIDC standard that allows agents to request "Async Auth" directly to a user's trusted device.

Let’s look at how we solve these so you can get back to your core LLM logic.

Auth0's Token Vault: Let the Agent Act (Without Touching the Keys)

When an autonomous agent runs in the background, it needs a valid third-party access token to act on the user's behalf.

The DIY Reality: Most teams start by storing encrypted user tokens in their primary relational database. This forces you to build and maintain a complex state machine: you have to write reliable cron jobs to handle refresh tokens before they expire, manage encryption-at-rest, and deal with the undocumented OAuth quirks of every third-party provider. If your database is ever compromised, you’ve leaked live credentials for every service your users have connected.

The Auth0's Token Vault Approach: Instead of your application holding onto sensitive third-party API tokens, you let Auth0 manage them securely. You fetch fresh tokens directly from the Vault on the fly.

Token Vault is built on top of OAuth 2.0 Token Exchange (RFC 8693) and supports social and enterprise connections to other Identity Providers (IdPs). There is no need to manage refresh tokens or build custom integrations per provider because Auth0 handles it all for you. You gain access to a wide range of external providers’ APIs and services, all through a single Auth0 integration.

First, you install the SDK. While we're using the Vercel-specific SDK for this example, Auth0 provides SDKs for multiple stacks (including Python and Java) that support Token Vault natively.

npm install @auth0/ai-vercel

For this example, we’ll use Slack to demonstrate the flow. You’ll initialize Auth0 for AI Agents and set up the connection to request access tokens with the required scopes for your specific third-party service.

import { Auth0AI } from "@auth0/ai-vercel";
import { auth0 } from "@/lib/auth0";

const auth0AI = new Auth0AI();

export const withSlack = auth0AI.withTokenVault({
  connection: "sign-in-with-slack",
  scopes: ["channels:read", "groups:read"],
  refreshToken: async () => {
    const session = await auth0.getSession();
    const refreshToken = session?.tokenSet.refreshToken as string;
    return refreshToken;
  },
});

The complete steps can be found in the documentation: List Slack Channels.

Beyond Slack - Auth for MCP: If you are building with the Model Context Protocol (MCP) to give agents access to private data, you still need to secure those connections. We’ve added a specific ASP.NET Core MCP server example to our samples repo to show you how to wrap your MCP servers in a secure identity layer.

CIBA: How an Agent Should Wait for User Consent

Here is a scenario that breaks standard OAuth: Your AI agent is running a background job at 2:00 AM. It realizes it needs to execute a high-stakes action (like transferring funds or deploying code), or it realizes its third-party access was revoked.

To complete the task, it needs the user's permission. But there is no browser session. The user is not using your app. How does a background script prompt a human?

The DIY Reality: The manual alternative is usually a custom microservice that pings the user with magic links via email or custom Slackbot webhooks. It requires building a custom notification service, a polling endpoint, and a complex state machine to track approvals out-of-band.

The CIBA Way - Enabling "Async Auth" so Agents can ask, and Humans can approve: CIBA is the actual OIDC spec designed for this exact out-of-band scenario. Your backend agent fires an API request to Auth0, which then pushes a cryptographically secure notification directly to a trusted device.

  • Agent: withAsyncAuthorization -> "Ask user to approve prod deployment."
  • User's Phone: Buzzes with a push notification. "Approve or Deny?"
  • Agent: Polls a single Auth0 endpoint until the user taps "Approve."

The Deployment Reality: CIBA requires a trust relationship with a specific device. To implement this, you do not have to force your users to download Auth0's proprietary Guardian app. You can use Auth0's SDKs to embed this push-notification approval flow directly into your own custom mobile app. While it’s not a drop-in fix for every guest user, for internal or B2B agents, it’s the most robust way to implement human-in-the-loop oversight without building custom notification infrastructure from scratch.

Focus on Your Agent, Not the Plumbing

Building a secure, encrypted token database and a custom push-notification approval flow is a massive engineering investment. You can spend the next quarter building "identity plumbing," or you can offload that burden to a dedicated layer.

By moving these requirements to Auth0, you eliminate the ongoing maintenance and the massive database security risk of rolling your own token vault. Auth0 for AI Agents is already live and available as an add-on for all our self-service plans.

Ready to start coding? Explore the Auth0 AI Samples repository on GitHub to find production-ready examples.

If you’re already on Auth0, you can upgrade and explore these features in the dashboard today to see how they fit your architecture. If you're stuck on the implementation logic, ping us at customeradvocate@auth0.com, we’re happy to help you get it into production.