Gemini Managed Agents adds a Credentials API that keeps secrets out of sandboxes

Google's Credentials API for Gemini Managed Agents lets agents authenticate to services like GitHub, Notion, and the Gemini API without placing raw secrets in the Linux sandbox. Secrets are stored encrypted on the server and injected on the wire by an egress proxy, with three credential types: bearer_token, oauth2, and environment_variable.