News for hackers. Stuff that matters.

A comment on Show HN: OneCLI – Vault for AI Agents in Rust.

Re:Show HN: OneCLI – Vault for AI Agents in Rust by captn3m0 on Thursday March 12, 2026 @01:29PM (#47354335)
This problem+solution, like many others in the agentic-space, have nothing agent-specific. Giving a "box" API keys was always considered a risk, and auth-proxying has existed as a solution forever. See tokenizer[0] by the fly.io team, which makes it a stateless service for eg - no database or dashboard. Or the buzzfeed SSO proxy, which lets you do the same via an OAuth2-dance at the frontend, and a upstream config at the backend which injects secrets: https://github.com/buzzfeed/sso/blob/549155a64d6c5f8916ed909....

[0]: https://github.com/superfly/tokenizer

[ Parent | on HN ]
Re:Show HN: OneCLI – Vault for AI Agents in Rust by RhodesianHunter on Thursday March 12, 2026 @01:35PM (#47354417)
Just because it's been done before for a different use-case doesn't mean that building exclusively for this use-case doesn't remove friction.
[ Parent | on HN ]
Re:Show HN: OneCLI – Vault for AI Agents in Rust by arianvanp on Friday March 13, 2026 @05:07AM (#47362117)
But it hasn't been built exclusively for that use case. It's literally the same.
[ Parent | on HN ]
Re:Show HN: OneCLI – Vault for AI Agents in Rust by Jonathanfishner on Friday March 13, 2026 @05:39AM (#47362315)
It's not the same. The core overlap is that agents shouldn't be holding raw credentials, that part isn't new, agreed. But the problem space goes further when you're building for agents specifically:

- Requiring human approval before sensitive actions go through (as @guyb3 mentioned in the post)

- Managing short-lived JWT tokens (refresh/access) with tight TTLs.

- Scoping permissions per-session rather than per-service

Auth-proxying solves the "don't give the box your API key" part. But the approval layer and token lifecycle management are what make this agent-specific, not just "SSO proxy repackaged."

[ Parent | on HN ]
Re:Show HN: OneCLI – Vault for AI Agents in Rust by multidude on Friday March 13, 2026 @06:49AM (#47362708)
I think you have a point. The credential part feels like a solved problem — auth-proxying has been around for a while. What seems genuinely new to me is the approval layer, the idea that a human should confirm before a sensitive action actually executes. I'm not sure that's covered by tokenizer or SSO proxy, but I could be wrong. Is that the real differentiator here, or am I missing something?
[ Parent | on HN ]