How Roblox Gives AI Agents Access Without Giving Them Credentials

AI agents that work on an engineer’s behalf may need to call a number of APIs. The simplest way to allow this is to give each agent long-lived API keys, but that puts those keys inside a process we cannot fully trust: a single prompt injection could leak them, and each additional key increases the damage a leak can cause.

This paper describes the approach Roblox uses instead. Each agent receives a short-lived identity tied to the engineer it works for. A Credential Broker stores the engineer’s vendor credentials and trades the agent’s identity for short-lived access tokens. An MCP Gateway then attaches those tokens to the agent’s outgoing requests, so in most cases the agent never sees a credential at all. The system currently handles traffic to more than 50 backend services and issues roughly 8,400 tokens per day, without any agent holding a long-lived credential