Backend services securely call third-party APIs using operator-provisioned credentials without exposing secrets in environment variables, config files, or logs.
The agent stores a credential (e.g., API key) in the Alter developer portal under Managed Secrets, creating a system-bound grant. It then identifies the grant_id associated with the secret. Finally, the agent configures the backend service to call the provider API using the Alter SDK's request method with the grant_id, allowing Alter to inject the credential securely into the outgoing call.
- Category: Operations and infrastructure
- Effect: Changes data in your accounts
- MCP servers: Alter Docs MCP (https://koskamo.com/explore/alter-docs-mcp)
- Source: Provision Secrets for Backend Services | Alter (https://docs.alterauth.com/guides/provision-secrets-for-backend-services/)
- Source quote: "By the end of this guide, a backend service calls a third-party API using an operator-provisioned credential — a Datadog API key, a Stripe secret key, an AWS access key — without that credential ever appearing in the application’s environment, config files, or logs."
- Playbook page: https://koskamo.com/explore/use-cases/provision-and-inject-backend-service-secrets
Prompt: Store the Datadog API key in Alter's Managed Secrets. Create a system-bound grant for the backend service. Then, show how the backend service uses the grant_id to call the Datadog API securely without hardcoding the key.