Trusty Squire

Read the vault audit ledger — "show me everything that touched my keys." Account-scoped, newest-first, NO secret values ever. By default (`view:"ledger"`) the response is SHAPED so it is readable: - `events` — the security ledger: credential stored / rotated / deleted / edited, grants minted / revoked, payments, plus every ANOMALY (`anomaly:true` with an `anomaly_reason` — non-2xx, 429, proxy error, rejected call). Routine successful egress is NOT listed here. - `egress.rollups` — routine proxied calls collapsed per credential x target host x burst: count, status breakdown, total bytes, first/last timestamp, and the grants covering that window. Pass a rollup's `id` back as `expand` to see its individual calls. - `grant_totals` — per egress grant: cumulative calls, bytes, last used. - `summary` — one human-readable line per rollup / headline. Escape hatches and filters: `view:"raw"` returns the flat unaggregated page (the original shape). `type` (an event kind), `reference` (a single credential), `limit` (rows, default 50, max 200), `before` (keyset cursor from `next_before`), `scan` (raw events read before shaping, default 500, max 2000) and `window_minutes` (burst gap, default 60) all still apply.

Soft-delete a vaulted credential only after the user approves the exact destructive action from the Telegram/passkey vouch link. Pass an exact vault reference, service, or saved credential name (combine service+name to disambiguate). The first call returns approval_pending and an approval_id. After the user approves, call delete_credential again with ONLY that approval_id. Retrying an approved approval_id is idempotent. No unsigned, expired, mismatched, ambiguous, or unknown request deletes anything.

Edit only non-secret metadata on a credential after the user approves the exact before→after change from the Telegram/passkey vouch link. Use allowed_hosts or login_hosts with mode add/remove/replace; label renames are also supported. Pass an exact vault reference, a service, or a saved credential name (combine service+name to disambiguate). The first call returns approval_pending and an approval_id. After the user approves, call edit_credential again with ONLY that approval_id. Unknown and immutable fields are rejected. This tool can never read or alter the stored secret value; rotate a secret only by calling store_credential with the new value.

Request an edit of a saved PAYMENT CARD (label, number, expiry, name, billing) behind the user's passkey approval. Identify the card by its exact id from list_payment_cards, or by its exact label. The first call returns approval_pending and an approval_id; the user opens the approval link and edits the card fields directly in the browser, where the card is decrypted and re-encrypted locally — the server stores only the new sealed blob and the agent never sees or chooses any card value. After the user finishes, call edit_payment_card again with ONLY that approval_id to confirm the result (idempotent). This tool can never read card data.

Return a vaulted credential's RAW value to you, in clear, after an explicit human passkey approval. Use it ONLY when unavoidable: the value lands in your context and therefore in the conversation transcript and any logs of it, which no later step can undo. Prefer `use_credential` whenever the task is "call an API with this key" — the server injects the secret into the HTTP request and returns only the upstream response, so the key never reaches you at all. Prefer an egress grant (`grant_app_access`) when a deployed app needs standing access. Reach for `fetch_credential` only when the raw key must physically land somewhere YOU control and no server-side injection path exists — writing it into a GitHub Actions secret, a .env file, or a config file. If you can accomplish the task without the plaintext, do that instead. Every fetch requires an explicit human passkey approval; there is no way to skip it. The first call resolves the credential and returns approval_pending with an approval_url — NO value. The user opens that link and signs with their passkey. Then call fetch_credential again with ONLY that approval_id to receive the value. Delivery is single-use: the same approval_id will not return the value twice, so store it where it needs to go on first receipt. A denied or expired approval returns a refusal and no value. Pass `field` to name one field of a multi-field credential (required when the credential has more than one — call list_credentials for its field names). Pass optional `reason` (short, in your own words) saying what you will do with the value so the owner can see who is asking and why.

Mint an egress grant: a revocable token + base URL so an app you DEPLOYED can call a provider using a vaulted credential, WITHOUT ever holding the raw key. Squire injects the real secret server-side at the boundary and enforces the credential's allowed_hosts. Point the app's SDK base URL at the returned `base_url` and authenticate with the returned `token` — the SDK's requests are forwarded to the provider with the real key swapped in. Pass `service` or `reference` to pick which vaulted credential to leash. Limits are OPT-IN and UNLIMITED by default: pass `rate_limit_per_hour` and/or `spend_cap_usd` ONLY if the caller wants a cap. Omit them for no rate/spend limit (the grant is still revocable + host-scoped + audited). SECURITY: the token is returned once through this MCP result, so it is visible to the host/model even though the raw provider key is not. Move it directly into BACKEND-ONLY deployment secret storage; never put it in client/browser code, logs, or source control. It is strictly safer than the raw key (scoped to one credential's hosts, rate-limitable, instantly revocable, audited), but it is still a bearer secret. Use use_credential instead when zero grant-token exposure to the model is required. Revoke any time; revocation is instant and needs no key rotation.

Release one saved card under the existing single human purchase approval and fill only the supplied observation refs. Supply session_id and refs for pan/cvv from operate_observe; each may target the main document or any reachable frame. Expiry, cardholder name, and billing are NOT inject targets and are not secret: after approval the result carries exp_month, exp_year, name, and any stored billing alongside last4, and you type those with operate_type/operate_select like any other field. After approval the session also exposes the card as opaque per-digit masked tokens you can place into ANY field ref yourself with operate_type: {{pan}} and {{cvv}} type the whole value, {{pan:N}} and {{cvv:N}} type one digit (1-based, N up to the returned pan_length/cvv_length); the broker substitutes the real digit at the keystroke boundary and the digits are never shown to you or masked out of every observation, screenshot, and error. Use the refs for the ordinary path and the tokens for arbitrary layouts, single-digit boxes, remounts, re-validation, or post-error re-arm. Avoid provider helper/autofill/focus inputs and choose the actual card control. This tool never searches for payment providers, chooses a card UI, reads or validates the total, clicks submit, clears fields, or diagnoses the checkout. Partial results are ordinary browser outcomes; retry changed refs with the same approval_id. Before placing the order, re-observe and confirm no competing saved-card control is selected. The operator detects a rendered 3-D Secure challenge on observation or action results and notifies the cardholder once; do not solve or wait on the challenge yourself — keep observing until the checkout resolves. The released PAN/CVV are masked from all normal operator output before the first write.

List the egress grants minted for this account — grant_id, which vaulted credential each leashes, rate limit, spend cap, created/revoked timestamps. The backend token itself is never returned (it is shown ONCE at mint time). Use this to find the grant_id to hand to revoke_app_access, or to audit what standing app access exists.

List the credentials already stored in the user's vault for this account. WHEN TO CALL THIS TOOL: - BEFORE provisioning a service — check whether the account already has a usable key for it, so you reuse the existing key instead of signing up for a duplicate - At the start of a task, to see what API keys are already available - Whenever you need a service's key and aren't sure it exists yet BEHAVIOR: - Returns metadata only — service, key name, type, age, and a vault `reference` — never the secret values themselves - The raw secret is never returned to you; to *use* a key, call use_credential with its `reference` (the server injects it) - Scoped to the user's account; only this account's credentials list FILTERS (all optional — with no filter the full metadata list is returned): - `service`: case-insensitive exact match on the service field; pass a string for one service or an array to match any of several - `fields: "summary"`: return only a compact projection per credential — reference, service, label, field_names, allowed_hosts, created_at, stale — instead of the full metadata object When checking whether a key exists for a specific service (e.g. before provisioning), pass `service` (and `fields: "summary"`) so the answer stays small instead of pulling the whole vault inventory into context.

List saved payment cards by opaque ID and user-visible label only. Never returns encrypted blobs or card data.

The action response is the compact `browser-use-control-query` control map by default: after a compact map on the same document, `delta:true` carries changed/new controls in `safe_table` and departed refs in `removed`, never the verbatim DOM. The acted control's own current row is always included, marked `w=acted`, so a write is confirmable from its own result. Pass `format:"full"` to receive the `browser-use-dom` tree instead. After inject_card releases a card, its PAN (complete ordinary spellings and prefixes of at least eight digits) and security code are replaced in every normal observation; all other emitted content stays verbatim. Prefer a current observation ref or unique @label. If a screenshot-visible control has no usable ref, pass screenshot:{screenshot_id,x,y} from operate_screenshot.click_binding, in original image pixels. Provide exactly one of ref or screenshot. target_unresolved means the label was never issued in this document; stale_ref means its reference or alias expired. stale_screenshot requires a new image. Each image binding permits one DISPATCHED attempt; invalid_screenshot_point (a point outside the image or one that resolves no node) does not consume the binding, so a corrected point may retry the same image. After an uncertain click, observe before deciding any new action. Dispatch does not guarantee challenge clearance. Use inject_card for saved-card field entry. A pointer-interception failure may use guarded DOM dispatch internally only when the executor proves no click was dispatched. Optional capture:{store,source:{role,name?,container?}|{selector,container?}} vaults exactly one revealed source and returns metadata only; the source is resolved against the document AFTER the action's mutation settles, and a stored result names the resolved element in resolved_source. Use a value-free CSS selector for a plain-text copy field without a textbox/code role. Resolution pierces open shadow roots: a bare selector, a role, or a cross-shadow [c…

Reveal masked keys and extract credentials from the current page: returns {credentials, candidate_count}. credentials may include `api_key` (or `api_key_truncated` if only a masked display was reachable) plus named fields for multi-credential services. Pass `store` to immediately save the extracted credential into the Trusty Squire vault with the session's observed hosts as allowed_hosts seed; when `store` is used, the response omits credential values and returns only vault metadata. Call when you have navigated to the keys page. With `into_slot`, a value that still looks masked is ranked behind a fully revealed sibling but never refused; pass `secret_label` (e.g. "client secret") to pick the right one when the page shows several credentials. Optional capture:{store,source:{role,name?,container?}|{selector,container?}} vaults exactly one revealed source and returns metadata only; the source is resolved against the document AFTER the action's mutation settles, and a stored result names the resolved element in resolved_source. Use a value-free CSS selector for a plain-text copy field without a textbox/code role. Resolution pierces open shadow roots: a bare selector, a role, or a cross-shadow [container] descendant selector all reach shadow-hosted fields (e.g. Groq's id-less created-key <input> inside an open shadow root); when the role is textbox, an id-less text input whose value looks secret-shaped also matches if it is the only textbox in the container/document. A source matching nothing returns error capture_unresolved with candidate_count 0 and a found list of the roles/names that DID render (never values) — use it to pick the next source; capture_ambiguous is reserved for more than one match. If storage is unresolved, retry operate_extract with capture.write_id. An unresolved capture does not block unrelated actions.

For a sign-in page, retrieve a username/password credential only if the current browser host is allowed for login, then seal requested fields into session slots. Raw values are never returned; use operate_type with slot with the returned slot names to fill the page.

Finish the task and close its session. outcome='none' closes without a reported outcome; 'credentials' extracts and vault-stores using store; 'result' reports summary or data — the reported outcome is recorded as-is. Successful completion saves eligible login state through the existing teardown.

Log in with provider + ref using the atomic OAuth flow; awaiting-human state is returned in this call. After a dispatched timeout or error, completion may be unknown: retain session_id and call operate_observe before another action; do not repeat OAuth blindly. Drive the sealed username/password login lifecycle without exposing raw values. action='prepare_signup' seals the user's captured email and a generated password; 'store_signup' vaults those prepared slots with the same login-host safeguards; 'load_saved' fetches an allowed saved login through encrypted browser-fill and seals its fields into session slots. Use operate_type with slot to fill returned slots.

Navigate to a URL without session host restrictions. Squire control-plane destinations remain refused.

Read raw browser evidence collected since session start: requests, responses, pending/completed/failed state, HTTP status, loading failures, CORS/blocked reasons, console messages, exceptions, and screenshot events. Pass the returned cursor as since for an incremental read, or request_id for one request. This surface does not diagnose payment stages. Released card PAN/CVV copies are masked; status bodies and all unrelated values remain visible.

Re-read the current page of an operate session. The default `format:"compact"` response is `browser-use-control-query`. It contains every actionable control (button, link, textbox, select, checkbox, radio, tab, menuitem, and file), including off-viewport controls; non-control markup and arbitrary page text are absent by construction, not redacted. Query or role filters this same map. Its `safe_table` is a paged control map: each row is `[ref,role,facts?]`; role is b=button, l=link, t=textbox, s=select, c=checkbox, r=radio, tb=tab, m=menuitem, or f=file; other roles are literal (e.g. slider or generic for a listener container). facts is a `|`-joined `@label` alias followed by present s=state (c=checked, u=unchecked, d=disabled, r=required), v=offscreen when outside the viewport, a=action, f=field, q=choice-position/total, and x=s same-origin or x=x cross-origin frame; absent x means main frame. nf=1 marks a listener container that carries a field name but is not itself fillable — its fillable field is emitted separately; fill that one. Query matches include m=n (exact name), m=r (exact role), m=t (local text), or m=c (explicit form/fieldset/dialog context), ranked in that order. semantic.blocked=true and semantic.blockers report what blocks the task independently of stage; stage=browse does not mean unblocked. Blocker kind is challenge (verification instructions), validation (a structurally identified field error), dialog (an open modal), or error_page (a CDN/gateway block wall named from the title/headings, so a blocked body is not read as a normal page). A dialog blocker also carries options — a bounded list of its rendered controls in DOM order, including the close path that keeps what was entered whenever the dialog renders one; when more controls exist than fit, that dismiss path and the controls that resolve the dialog are kept ahead of anchors, so query the control map for the rest. ref names the dialog's exit, matched on a control's whole label, or is absent…

The action response is the compact `browser-use-control-query` control map by default: after a compact map on the same document, `delta:true` carries changed/new controls in `safe_table` and departed refs in `removed`, never the verbatim DOM. The acted control's own current row is always included, marked `w=acted`, so a write is confirmable from its own result. Pass `format:"full"` to receive the `browser-use-dom` tree instead. After inject_card releases a card, its PAN (complete ordinary spellings and prefixes of at least eight digits) and security code are replaced in every normal observation; all other emitted content stays verbatim. Press a keyboard key in the current session, such as Enter, Tab, or Escape. Optional capture:{store,source:{role,name?,container?}|{selector,container?}} vaults exactly one revealed source and returns metadata only; the source is resolved against the document AFTER the action's mutation settles, and a stored result names the resolved element in resolved_source. Use a value-free CSS selector for a plain-text copy field without a textbox/code role. Resolution pierces open shadow roots: a bare selector, a role, or a cross-shadow [container] descendant selector all reach shadow-hosted fields (e.g. Groq's id-less created-key <input> inside an open shadow root); when the role is textbox, an id-less text input whose value looks secret-shaped also matches if it is the only textbox in the container/document. A source matching nothing returns error capture_unresolved with candidate_count 0 and a found list of the roles/names that DID render (never values) — use it to pick the next source; capture_ambiguous is reserved for more than one match. If storage is unresolved, retry operate_extract with capture.write_id. An unresolved capture does not block unrelated actions.

Read the session's signed-in Gmail inbox for a verification email and return {code, link, source_from} WITHOUT touching the live page: the read runs in a dedicated tab that is closed when done, so a signup form or dialog waiting for the code stays exactly as it is. NEVER navigate the session to the mailbox for a code or link — navigating away and back resets the form and closes the waiting dialog. `sender` narrows the search — matched against the From address, its display name, AND the subject (e.g. "proton.me"); the newest matching mail is the one read, cross-checked across the search listing AND the real-time All Mail listing (Gmail's search index can lag fresh mail by minutes — found:false means the mail is not in the mailbox, not that the search was stale). `into_slot` seals a found OTP into a session slot so it is typed with operate_type slot and never crosses the MCP boundary; `grant_inbox_consent` overrides the session's inbox-read consent for this call. Returns needs_user when nothing is found yet — retry after a few seconds or ask the user (the session stays live).

WARNING: EXPENSIVE — a screenshot is a full image and costs far more context than any observation. Reach for it ONLY when the DOM tree or control search (operate_observe with query/cursor) is NOT sufficient to determine the page state; if the observation already tells you what the page is doing, do not take one. Debugging tool: capture a screenshot of what the operate session's browser actually RENDERS — the whole page (default: viewport; full_page:true for the whole scrollable page) or ONE specific frame in isolation via frame_index or frame_url_contains, so a cross-origin challenge iframe (a 3-D Secure ACS frame, a captcha) can be captured on its own even when it won't show clearly inside a full-page shot. Use this when the DOM tree from an explicitly selected full observation isn't enough to tell what state a stuck page is actually in — a challenge that never advances, an unexpected layout, a captcha you need to SEE. Read-only: never navigates, clicks, types, submits, or steals focus; it only reads pixels. After inject_card releases a card, pixels containing that card's PAN (complete ordinary spellings or prefixes of at least eight digits) or security code in injected controls and identified ordinary displayed copies are covered in the returned image; surrounding borders, labels, and errors remain visible. An active mask is never bypassed: if the mask cannot scan or composite the capture, the screenshot call fails rather than returning the unmasked image. When click_binding is present, its screenshot_id and original image width/height authorize one operate_click screenshot point for 60 seconds. Navigation, viewport/scroll or frame geometry changes invalidate it. An absent binding means this image is read-only; capture again for a coordinate click.

The action response is the compact `browser-use-control-query` control map by default: after a compact map on the same document, `delta:true` carries changed/new controls in `safe_table` and departed refs in `removed`, never the verbatim DOM. The acted control's own current row is always included, marked `w=acted`, so a write is confirmable from its own result. Pass `format:"full"` to receive the `browser-use-dom` tree instead. After inject_card releases a card, its PAN (complete ordinary spellings and prefixes of at least eight digits) and security code are replaced in every normal observation; all other emitted content stays verbatim. Scroll the page viewport down, up, to the bottom, or to the top. Observe again to discover newly visible controls.

The action response is the compact `browser-use-control-query` control map by default: after a compact map on the same document, `delta:true` carries changed/new controls in `safe_table` and departed refs in `removed`, never the verbatim DOM. The acted control's own current row is always included, marked `w=acted`, so a write is confirmable from its own result. Pass `format:"full"` to receive the `browser-use-dom` tree instead. After inject_card releases a card, its PAN (complete ordinary spellings and prefixes of at least eight digits) and security code are replaced in every normal observation; all other emitted content stays verbatim. Choose an option by visible text with ref + values (one value per control). For several controls, supply an ordered selections map of ref to option; partial results are retained. country selects the phone field's native country dropdown. Optional capture:{store,source:{role,name?,container?}|{selector,container?}} vaults exactly one revealed source and returns metadata only; the source is resolved against the document AFTER the action's mutation settles, and a stored result names the resolved element in resolved_source. Use a value-free CSS selector for a plain-text copy field without a textbox/code role. Resolution pierces open shadow roots: a bare selector, a role, or a cross-shadow [container] descendant selector all reach shadow-hosted fields (e.g. Groq's id-less created-key <input> inside an open shadow root); when the role is textbox, an id-less text input whose value looks secret-shaped also matches if it is the only textbox in the container/document. A source matching nothing returns error capture_unresolved with candidate_count 0 and a found list of the roles/names that DID render (never values) — use it to pick the next source; capture_ambiguous is reserved for more than one match. If storage is unresolved, retry operate_extract with capture.write_id. An unresolved capture does not block unrelated actions.

Begin an interactive website task: opens a browser on the user's machine at service_url and returns the initial page observation. The default `format:"compact"` response is `browser-use-control-query`. It contains every actionable control (button, link, textbox, select, checkbox, radio, tab, menuitem, and file), including off-viewport controls; non-control markup and arbitrary page text are absent by construction, not redacted. Query or role filters this same map. Its `safe_table` is a paged control map: each row is `[ref,role,facts?]`; role is b=button, l=link, t=textbox, s=select, c=checkbox, r=radio, tb=tab, m=menuitem, or f=file; other roles are literal (e.g. slider or generic for a listener container). facts is a `|`-joined `@label` alias followed by present s=state (c=checked, u=unchecked, d=disabled, r=required), v=offscreen when outside the viewport, a=action, f=field, q=choice-position/total, and x=s same-origin or x=x cross-origin frame; absent x means main frame. nf=1 marks a listener container that carries a field name but is not itself fillable — its fillable field is emitted separately; fill that one. Query matches include m=n (exact name), m=r (exact role), m=t (local text), or m=c (explicit form/fieldset/dialog context), ranked in that order. semantic.blocked=true and semantic.blockers report what blocks the task independently of stage; stage=browse does not mean unblocked. Blocker kind is challenge (verification instructions), validation (a structurally identified field error), dialog (an open modal), or error_page (a CDN/gateway block wall named from the title/headings, so a blocked body is not read as a normal page). A dialog blocker also carries options — a bounded list of its rendered controls in DOM order, including the close path that keeps what was entered whenever the dialog renders one; when more controls exist than fit, that dismiss path and the controls that resolve the dialog are kept ahead of anchors, so query the control map for the r…

The action response is the compact `browser-use-control-query` control map by default: after a compact map on the same document, `delta:true` carries changed/new controls in `safe_table` and departed refs in `removed`, never the verbatim DOM. The acted control's own current row is always included, marked `w=acted`, so a write is confirmable from its own result. Pass `format:"full"` to receive the `browser-use-dom` tree instead. After inject_card releases a card, its PAN (complete ordinary spellings and prefixes of at least eight digits) and security code are replaced in every normal observation; all other emitted content stays verbatim. Fill a control with text, or a session slot returned by operate_login, operate_fill_credential, or operate_extract. Provide exactly one of text or slot. submit presses Enter after a successful fill. Optional capture:{store,source:{role,name?,container?}|{selector,container?}} vaults exactly one revealed source and returns metadata only; the source is resolved against the document AFTER the action's mutation settles, and a stored result names the resolved element in resolved_source. Use a value-free CSS selector for a plain-text copy field without a textbox/code role. Resolution pierces open shadow roots: a bare selector, a role, or a cross-shadow [container] descendant selector all reach shadow-hosted fields (e.g. Groq's id-less created-key <input> inside an open shadow root); when the role is textbox, an id-less text input whose value looks secret-shaped also matches if it is the only textbox in the container/document. A source matching nothing returns error capture_unresolved with candidate_count 0 and a found list of the roles/names that DID render (never values) — use it to pick the next source; capture_ambiguous is reserved for more than one match. If storage is unresolved, retry operate_extract with capture.write_id. An unresolved capture does not block unrelated actions.

The action response is the compact `browser-use-control-query` control map by default: after a compact map on the same document, `delta:true` carries changed/new controls in `safe_table` and departed refs in `removed`, never the verbatim DOM. The acted control's own current row is always included, marked `w=acted`, so a write is confirmable from its own result. Pass `format:"full"` to receive the `browser-use-dom` tree instead. After inject_card releases a card, its PAN (complete ordinary spellings and prefixes of at least eight digits) and security code are replaced in every normal observation; all other emitted content stays verbatim. Wait briefly for the live page to change, then return a fresh observation. Use this for spinners, late-mounted fields, and pending requests without assigning them a payment stage.

Revoke an egress grant on the spot — "something leaked, kill that token now." Pass the `grant_id` returned by grant_app_access (or list_app_access). Revocation is INSTANT and global: the next request through that grant's proxy is rejected (403), no key rotation required. The vaulted credential itself is untouched and any other grants on it keep working. Use this the moment a backend egress token is suspected leaked.

Save a secret the user just shared into the encrypted vault. CALL THIS AUTOMATICALLY whenever the user pastes a secret-shaped value (sk-, ghp_, AKIA, eyJ; password/token/connection-string patterns) — don't ask first. One entry per (service, label) — re-storing the same service rotates only its secret fields and preserves existing metadata. Use edit_credential for metadata changes. For multi-part credentials (AWS access key + secret, DB user+password) pass `fields` (e.g. {access_key_id, secret_access_key}); for a lone key pass `value`. Optional `label` (default "default") keeps prod/dev keys for the same service apart. Optional `auth_shape` records how the provider expects the key so an EGRESS GRANT (grant_app_access) auto-injects it correctly: "bearer" (default) | "header:<name>" (e.g. "header:x-api-key") | "query:<param>". Set it for non-bearer providers; bearer needs nothing. Optional `observed_hosts` carries hosts seen during signup/extraction and is unioned into the credential's allowed_hosts with the service defaults. For username/password credentials, pass `auth_strategy: "username_password"` and explicit `login_hosts`; those credentials cannot be spent through `use_credential` and can only be sealed into browser-fill slots on allowed signin hosts. Returns the reference, field names, and allowed_hosts. The value is never readable back to you afterwards.

Execute an authenticated HTTP request against an external API using a vaulted credential. The secret value NEVER crosses to this agent — the server injects it and returns only the upstream response. In your headers/body use ${SECRET} for a single-field credential, or ${SECRET.<field>} for a multi-field one (e.g. ${SECRET.access_key_id}, ${SECRET.secret_access_key}); ${SECRET_JSON[.field]} JSON-escapes. Call list_credentials to see a credential's field names. Pass `service` or `reference` plus the HTTP fields (method, url, headers, body). Prefer this over fetch_credential for every "call an API with the key" task: the value never enters your context, and no human approval is needed. For APIs that authenticate via a query-string key (e.g. FRED's `api_key`), put the secret in `query` — `query: { api_key: "${SECRET}" }` — NOT in the url (a ${SECRET} in the url is rejected; the server injects query params after the host check so the key never lands in a log). The target host must be on the credential's allowed_hosts (editable with edit_credential after a signed vouch, or in the web vault) or the call is rejected.