Rhumb's public discovery surface covers 999 scored services and 435 capability definitions, while current callable execution is narrower at 18 callable providers strongest for research, extraction, generation, and narrow enrichment. Choose the credential path for the workflow that can actually run, not for the catalog you hope to expose someday.
The decision rule
Start with authority, not storage. A secret can live in the right place and still authorize the wrong action. The production question is whether the rail preserves actor, scope, quota, provider path, denial case, and receipt evidence before the agent repeats the call.
The simplest honest path is a governed key for a Rhumb-managed capability. The moment the workflow crosses into your provider account, customer data, workspace state, or compliance boundary, the credential path becomes part of the product contract.
Credential path matrix
Best when
Repeat Rhumb-managed capabilities where the operator wants a stable production rail.
Must prove
Agent identity, allowed capability, budget owner, usage label, and receipt evidence before repeat execution.
Avoid
Do not use it to hide customer-owned system access behind Rhumb credentials.
Best when
Workflows that must act through the operator's provider account, workspace, billing relationship, or compliance boundary.
Must prove
The call used the intended upstream account, scope, tenant, and quota owner rather than a shared default key.
Avoid
Do not treat key custody as authorization. The execution layer still needs scope checks, typed denials, and receipts.
Best when
Repeat workflows where credentials should be encrypted, scoped to an agent, and resolved only at execution time.
Must prove
Vault token, connection reference, agent id, organization id, credential mode, and DSN or provider handle stayed bound together.
Avoid
Do not mistake vaulting for permission. Vault lookup is the authority boundary, not a convenience parser.
Best when
Zero-signup trials, one-off paid calls, and workflows where the payment proof is part of the product experience.
Must prove
Payment request id, X-Payment proof, wallet identity, amount, and verification outcome matched before credit or execution state changed.
Avoid
Do not use it as a substitute for a stable budget owner when the workflow will call repeatedly in production.
Best when
Cases where the operator already knows the provider path and wants deterministic control rather than best-fit routing.
Must prove
The pinned provider, credential mode, cost ceiling, denial behavior, and fallback policy were explicit before the agent called it.
Avoid
Do not let pinning bypass resolve, estimate, budget, or receipt evidence just because the provider name is known.
Proof before the first repeat call
A credential choice is ready for agent execution when the adjacent unsafe case fails clearly. If the workflow can only show a happy-path call, it has not proven the credential boundary.
Common credential-path mistakes
- A single service account powering every agent, tenant, and workflow with no caller-visible budget attribution.
- A vault that resolves secrets correctly but leaves authorization to downstream provider luck.
- A wallet proof that credits execution before payment_request_id, amount, and proof family are normalized.
- A provider pin that skips estimate, denial, or receipt checks because the human already picked the vendor.
- A BYOK setup that stores the key safely but never proves scope, revocation, or quota ownership under retry.
Where Rhumb routes this today
Use Resolve key management for the rail model, Start Managed Execution when you can name one repeat workflow, and API Credentials in Autonomous Agent Fleets when your risk is lifecycle drift across many agents.
The E-006 proof sprint is deliberately request-first: it asks for the one workflow, the expected volume, the denial case, and the trace proof before treating a paid call as buying intent.
Related reading
Composio, Arcade, Nango Alternatives
Decide whether the job is integration infrastructure, MCP runtime, tool access, or governed execution proof.
Resolve key management
The product model for governed keys, BYOK, Agent Vault, x402, and provider pinning.
Start managed execution
Scope one repeat workflow before wiring a paid call into an agent loop.
Price the First Repeat Agent Workflow
Estimate route, rail, cost ceiling, denial, and receipt proof before a credential path repeats.
API Credentials in Autonomous Agent Fleets
Credential lifecycle, rotation, expiry, revocation, and scope drift once multiple agents run.
Securing Keys for Agents
Why the authority boundary matters more than credential format.