Which action should be avoided when configuring credentials for an external integration?

When integrating external tools with AI agents, security best practices dictate that sensitive secrets, API keys, and bearer tokens must never be embedded in plain text within agent prompts or system instructions. Large language models process system instructions as part of their context window, making embedded credentials susceptible to prompt injection, unauthorized extraction, or accidental exposure in conversational logs. Instead, authentication parameters should be handled securely through dedicated vault services, secret managers, or encrypted credential stores configured at the API connection boundary. Avoiding the inclusion of sensitive credentials in instruction prompts safeguards enterprise access keys, maintains compliance with data protection standards, and ensures robust secure integration management.

A. Using supported, industry-standard authentication methods (like OAuth 2.0 or mutual TLS) is a required best practice for establishing secure external integrations.
B. Restricting access to credentials using fine-grained IAM policies and key management systems is essential to protect administrative access and sensitive secrets.
C. Testing authentication mechanisms prior to production deployment is necessary to verify connectivity, validate permissions, and ensure integration reliability.

- Oracle Cloud Infrastructure Security Guide: Managing Secrets and API Key Security in OCI Vault. Oracle Corporation, 2024. Section: "Securing Integration Credentials".

- OWASP Foundation. (2023). OWASP Top 10 for Large Language Model Applications: LLM06 - Sensitive Information Disclosure and LLM01 - Prompt Injection. https://owasp.org/www-project-top-10-for-large-language-model-applications/