Secrets management

Allowed hosts and bound tools

Every Autessa secret lists the exact hostnames it may be sent to, such as api.stripe.com, and is only ever sent over HTTPS. A request that would send it anywhere else is not made, so even a tool someone edits, by mistake or on purpose, cannot send your Stripe key to any server except Stripe’s. Binding a secret to tools limits it further.

Start free

Outgoing requests · one executionSample

https://api.stripe.com/v1/chargesValue filled in

https://evil.example/collectSECRET_HOST_NOT_ALLOWED

http://api.stripe.com/v1/chargesHTTPS only

https://eu.api.stripe.com/v1Exact hostname only

If the service echoes the value back, the script sees [redacted secret].

The problem

What problem does it solve?

The real risk with a stored credential is not that someone reads it; it is that a changed script quietly sends it somewhere else. Controlling destinations closes that door.

How it works

1
List allowed hosts
At least one, up to 50. Hostnames match exactly: api.example.com does not also allow example.com or eu.api.example.com, and wildcards are not accepted.
2
HTTPS only
A handle is filled in only when the endpoint uses https:// and the hostname matches. It is never allowed in the hostname itself.
3
Bind to tools (optional)
Bound secrets work only from those tools, no matter who runs them, which lets a tool call a paid API for app visitors, webhook senders or scheduled jobs.
4
Denials are logged
A blocked request returns SECRET_HOST_NOT_ALLOWED; a refused use adds USE_DENIED to the audit log.

Every option

Allowed hosts and bound tools: settings and options

Setting	What it does
allowedHosts	Exact lowercase hostnames, no schemes, paths, ports or wildcards. Required.
boundToolIds	Empty means any tool run by someone with Use access.
Background runs	Runs that do not act for any person can use only secrets bound to the tool they run.

Permissions

Who can do what?

Who	What they can do
Manage	Change allowed hosts and bound tools.
Tool editors	Should be limited on bound tools, because anyone who can run a bound tool uses the secret through it.

FOR DEVELOPERS

autessa secrets update help (excerpt)bash

update  Change a secret's description, allowedHosts, boundToolIds or showLast4.

What to know

Bind a secret only to tools whose script you trust, and limit who can edit those tools.

Read the docs: Allowed hosts →

Connections

How Allowed hosts and bound tools connects to the rest of Autessa

Secrets vault →

How a handle becomes a value.

AI Agent Firewall →

Allowed sites and egress approval for what agents send out.

Reports, policies and security questionnaires are on the Autessa Trust Center.

FAQ

Allowed hosts and bound tools: questions

Can I allow *.example.com?

No. Wildcards are not accepted; list each exact hostname, up to 50.

How can a public app use a paid API key without sharing it?

Bind the secret to the tool the app calls. Bound secrets work from that tool no matter who runs it.

Get started with Allowed hosts and bound tools

A secret is sent only over HTTPS to the exact hostnames you list, so even an edited tool cannot send your Stripe key anywhere but Stripe, and binding limits it to the tools you trust.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours