How Auth Proxy Protects LangSmith Agent Sandboxes

AI agents are like creating thousands, even millions, of "untrusted developers." Each agent can write code, install packages, and call APIs. Unlike human developers, agent environments should be restrictive by default, allowing only the minimum network access needed for the task.

LangSmith Auth Proxy handles network-layer authentication outside the sandbox. Instead of placing API keys into the sandbox as environment variables or files, the proxy sits on the outbound network path and controls access to external services. Sandbox code makes normal API requests, and the proxy handles credentials and access rules at the network layer.

Three key benefits:

• Credentials stay outside the runtime: Agents cannot read API keys, protecting against prompt injection, malicious dependencies, and logging mistakes
• Explicit network access: If an agent should only call OpenAI, Anthropic, and GitHub, this can be enforced as infrastructure policy
• Separation of concerns: The agent focuses on the task, the sandbox on isolation, and the proxy on network authentication

The proxy supports three header types: workspace_secret (references a LangSmith workspace secret), plaintext (non-sensitive headers), and opaque (write-only, encrypted). For example, when a sandbox calls api.openai.com, the proxy automatically injects the Authorization header.

Dynamic credential callbacks support more advanced use cases as well. When short-lived OAuth tokens, per-user tokens, or credentials issued by an internal auth service are needed, the proxy calls a configured callback endpoint to fetch the headers. If the callback fails, the request is rejected, operating in a fail-closed manner.

Network control is just as important as credentials. Through the proxy, teams can define egress policies:

• Allow only model provider APIs and block everything else
• Allow only specific paths on the GitHub API
• Allow only internal mirrors for package registries
• Block known malicious registries

Possible future extensions include DNS remapping (redirecting public package registries to an internal Artifactory), network logging (audit trails of agent behavior), and request transformation (stripping PII, adding organization metadata).