Agent sandboxes often ship with a long-lived API key baked into the environment. That is convenient for demos and dangerous in production. If a session leaks, the key leaks with it.
Treat every sandbox credential as disposable. Issue a short-lived key when the session starts, scope it to the tools that session needs, and revoke it when the session ends. Rotation is not a monthly chore here. It is part of the session lifecycle.
Start with per-session issuance. Your orchestrator should call an identity service that returns a token with an expiry measured in minutes or hours, not weeks. Bind the token to the sandbox id so a stolen key from one box does not work elsewhere.
Scope tightly. A research agent does not need write access to billing APIs. A code agent does not need production deploy rights. Prefer tool-specific credentials over one master key that unlocks everything the company owns.
Rotate on a schedule even if sessions are short. Keys that survive a crash or a hung worker can linger. A background job that revokes anything older than your max session age closes that gap. Pair that with logs that show which sandbox used which key id.
Never put the root key in the sandbox filesystem. Inject it through a secrets broker at runtime, or through a short-lived sidecar that mints child tokens. If the agent can print env vars into a tool result, assume the user or a later model turn can see them.
Plan for compromise. When you rotate, keep a brief overlap window so in-flight tool calls finish, then revoke the old key. Document the kill switch: one command that invalidates all sandbox credentials for a project. Test that path the same way you test deploys.
Watch for secondary secrets. Agents often write .env files, cache tokens in workspace folders, or paste keys into scratch notes. Scrub those paths on session end. Prefer memory-only injection when the runtime allows it.
If you share sandboxes across users, never reuse keys between tenants. Isolation failures happen. Key isolation is a second fence. Emit an audit event on mint, use, refresh, and revoke so you can answer who had access when something went wrong.
Vendor APIs differ. Some support short TTLs and fine scopes. Others only offer static keys. In the second case, put a proxy in front that authenticates the sandbox, rate-limits calls, and holds the real key. The sandbox talks to your proxy with a session token you control.
Rotation will feel like friction the first week. After the first leaked demo key, it feels like the baseline. Build it into session start and session end, and treat any long-lived sandbox key as a bug.
Add a watchdog that checks token age every minute. When a token approaches its expiry, the watchdog triggers a silent refresh and updates the sandbox environment without interrupting the user. Record each refresh event with a timestamp and the originating sandbox ID so you can trace any gap.
Tie rotation into your CI/CD pipeline. When a new build deploys a sandbox image, the pipeline calls the identity service, stores the returned token in a temporary secret store, and injects it at container start. The same pipeline also registers a cleanup step that revokes the token after the test suite finishes.
Prepare an emergency kill switch. A single admin command should enumerate all active sandbox tokens for a project and invalidate them in one atomic operation. Log the command, the operator, and the list of revoked IDs. Test this path regularly so you know it works under load.