Core Concepts | Gazebo Docs

Services

A service is an external API that Gazebo manages credentials for — Stripe, GitHub, Cloudflare, Vercel, Resend, OpenAI, and others. When you connect a service, you provide the API key or OAuth token for that service. Gazebo encrypts and stores it in the vault.

Vault

The vault is the encrypted store of your service credentials. Each credential is encrypted with AES-256-GCM before being written to disk. Plaintext values are never returned to a browser after initial storage — they are only ever decrypted to fulfill an authorized agent credential request.

See Credential storage for the full details.

Access profiles

An access profile is a named, scoped permission set. It defines which services an agent can access and which HTTP methods are permitted per service.

Profiles are the unit of authorization. An agent's access is fully determined by its linked profile — you change what an agent can do by editing its profile, not the agent itself.

Agents

An agent is an AI tool or automated process that needs access to your service credentials. In Gazebo, an agent is represented by:

A name (e.g. cursor-dev, deploy-bot)
A linked access profile (what it's allowed to access)
A bearer token (how it authenticates with Gazebo)

An agent in Gazebo is not the AI model itself — it's the identity and permission set you assign to a particular tool or workflow.

Bearer tokens

A bearer token is the credential an agent uses to authenticate with Gazebo. It's a secret string, formatted ag_..., that the agent includes in every request to Gazebo.

The token identifies the agent and resolves its access policy. It does not contain credential values — those are fetched per-request by calling get_credential.

Tokens are issued when you create or regenerate an agent. They do not expire automatically but can be revoked by deleting the agent.

Audit logs

Every call to get_credential — successful or denied — is recorded in the audit log with:

The agent identity
The service requested
The HTTP method requested
The outcome (success or denial reason)
The timestamp

Audit logs are append-only. They cannot be deleted from the dashboard.

Services

Vault

See Credential storage for the full details.

Access profiles

An access profile is a named, scoped permission set. It defines which services an agent can access and which HTTP methods are permitted per service.

Profiles are the unit of authorization. An agent's access is fully determined by its linked profile — you change what an agent can do by editing its profile, not the agent itself.

Agents

An agent is an AI tool or automated process that needs access to your service credentials. In Gazebo, an agent is represented by:

A name (e.g. cursor-dev, deploy-bot)
A linked access profile (what it's allowed to access)
A bearer token (how it authenticates with Gazebo)

An agent in Gazebo is not the AI model itself — it's the identity and permission set you assign to a particular tool or workflow.

Bearer tokens

A bearer token is the credential an agent uses to authenticate with Gazebo. It's a secret string, formatted ag_..., that the agent includes in every request to Gazebo.

The token identifies the agent and resolves its access policy. It does not contain credential values — those are fetched per-request by calling get_credential.

Tokens are issued when you create or regenerate an agent. They do not expire automatically but can be revoked by deleting the agent.

Audit logs

Every call to get_credential — successful or denied — is recorded in the audit log with:

The agent identity
The service requested
The HTTP method requested
The outcome (success or denial reason)
The timestamp

Audit logs are append-only. They cannot be deleted from the dashboard.