Token Vault # Connect AI agents to apps and APIs Token Vault integrates your apps and AI agents with third-party tools. It handles access and refresh tokens automatically, so you don’t have to. - [Get started](https://auth0.com/signup?onboard_app=auth_for_aa&ocid=701KZ000000cXXxYAM-aPA4z0000008OZeGAM) - [Read our docs](https://auth0.com/ai/docs/intro/overview) ## AI agents, meet external tools Build an AI agent that can book flights, respond to emails, and get stuff done. ## Integrations Empower agents to search your Gmail inbox, create a GitHub pull request, build a Spotify playlist, or leverage one of our 30+ integrations to do even more. - [Explore all integrations](https://auth0.com/ai/docs/integrations/overview) ## Start building with your favorite framework - LangChain - LlamaIndex - Cloudflare Agents - AI SDK by Vercel - Firebase Genkit ## Trusted by developers > "Removing sensitive values (like keys/secrets) from code is essential. The next-level unlock is then being able to dynamically exchange an inert variable for the real key. The ability for Token Vault to handle this with such a seamless DX makes it a no brainer for those building AI Agents that talk to authorized integrations. Really incredible work by the Auth0 team." > — Sean Roberts, VP of Applied AI > "When building agentic applications with LlamaIndex, building a capable agent is only the first step: you have to make sure it's safe and secure before you can ship it. Auth0 is the industry leader in tackling this problem and we're delighted to integrate with them." > — Murtaza Khomusi, Head of Product Marketing ## See it in action Watch the demo to see how Token Vault works in practice. Want more details? - [Check out the code](https://github.com/auth0-samples/auth0-assistant0) ## Frequently asked questions ### What is the Auth0 Token Vault? The [Auth0 Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault) is a security feature that manages and protects third-party API tokens used by AI agents on behalf of users. It stores, retrieves, and automatically refreshes OAuth 2.0 tokens for external services (such as Google, GitHub, Salesforce, etc.), verifying that sensitive credentials are not exposed to AI agents or client-side code. This significantly reduces the risk of token theft and unauthorized API access in modern agentic architectures. ### What problem does Token Vault solve for AI agents? AI agents often need to perform actions across multiple third-party services on a user's behalf, such as reading emails, creating calendar events, or updating CRM records. Without Token Vault, developers would need to manage token storage, refresh logic, and secure access themselves, risking token leakage to the agent or insecure storage. Token Vault solves this by providing a dedicated, secure layer that manages the full token lifecycle, allowing agents to [request API access](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/access-token-exchange-with-token-vault) at runtime without possessing or seeing raw user credentials. ### How does the user workflow for connecting a third-party service or application work? [AI agent applications direct the user to Auth0 to authenticate with a third-party service](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/connected-accounts-for-token-vault) (e.g., Google) via a standard OAuth 2.0 consent flow. Once the user grants consent, Auth0 stores the resulting refresh token in Token Vault. When an AI agent or application needs to call that third-party API on the user's behalf, it requests a valid access token from Token Vault using a more secure, scoped API call. Token Vault uses the refresh token to request a short-lived access token and returns it to the agent to make the API call. The user only authenticates once, and Token Vault manages ongoing access. ### What are Integrations in the context of Token Vault? Integrations are pre-configured connections to third-party services (such as Google, GitHub, Slack, Salesforce, and LinkedIn) that define how Auth0 [authenticates](https://auth0.com/platform/authentication) with those services on behalf of a user. Each integration specifies the OAuth 2.0 provider details, required scopes, and credentials. Auth0 provides a catalog of [supported integrations](https://auth0.com/ai/docs/integrations/overview) that can be set up through the Auth0 dashboard, making it straightforward to connect new external services to your application or agent without writing custom OAuth plumbing. ### How does Token Vault secure AI agents? Auth0 Token Vault helps secure AI agents by acting as a 'broker' for API calls. Instead of the AI agent holding a long-lived secret, it requests a short-lived token from the vault to perform specific tasks. This limits the blast radius if an agent is compromised and provides a clear audit trail of which agent accessed which external service and when. ### Can I audit token usage in the Vault? The Auth0 Token Vault provides comprehensive logging and auditing for every token retrieval event. Security teams can monitor which applications or agents are calling specific APIs, identifying unusual patterns that might indicate a breach or misuse. This visibility is essential for maintaining compliance in highly regulated AI and data-driven environments. ### Is Token Vault compatible with any service or application? Auth0 Token Vault is designed to be highly flexible, supporting any third-party service that uses standard OAuth 2.0 authentication flows. Auth0 provides a growing catalog of pre-built integrations for popular services and allows configuring [custom integrations for other OAuth 2.0-compatible providers](https://auth0.com/ai/docs/integrations/oauth2). This allows developers to secure a wide range of integrations under a single, unified security and identity framework managed by Auth0. ## Auth0 for AI Agents Enable AI agents to more securely access tools, workflows, and data with fine-grained control and just a few lines of code. - [Get started](https://auth0.com/signup?onboard_app=auth_for_aa&ocid=701KZ000000cXXxYAM-aPA4z0000008OZeGAM) - [Read our docs](https://auth0.com/ai/docs/intro/overview)