AgentPMT

Connected APIs

Connect Any API to Your Agent

Use a prebuilt marketplace connection, or add your own endpoint in under a minute. Either way, AgentPMT injects the secret at request time — the key never reaches the model.

Browse Prebuilt Connections

No credit card required.

Trusted and Certified

  • CASA Tier 2 CertifiedAudited by TAC Security for secure app access.
  • Encrypted at RestCredentials are stored encrypted and injected server-side.
  • Full Audit TrailConnected API calls are recorded with operational context.

Two ways to connect your APIs

Start with a prebuilt connection from the marketplace, or add any HTTP API yourself. Every connection keeps the credential on our servers.

Use a prebuilt connection

Popular connections include Google Workspace, GitHub, Twilio, Pipedrive, YouTube, X, Telegram, and Blender. Browse the full catalog and install in a click.

Browse the marketplace →

Add your own endpoint

Need something we don't have yet? Add any HTTP API as a Connected API — approve the URL, pick the auth, and your agent can call it in under a minute. That's what the rest of this page covers.

See the setup flow →

How It Works

  1. Add the API

    Paste the base URL and pick the auth type — API key, bearer token, OAuth, Basic Auth, or a custom header.

  2. Connect the key

    We store the credential encrypted and you choose where it goes — header, body, or query — using the exact name the upstream API expects.

  3. Point your agent at it

    Your agent calls AgentPMT. We check the request against your approved URLs and methods, attach the secret at the last moment, and forward it. The key never reaches the model.

The credential is attached on our servers at request time — never in the prompt, the context, or the model's memory.

30 Second Setup

Add the endpoint, connect the credential, and keep every runtime call behind the same server-side policy.

Connected APIs dashboard listing a live Acme CRM proxy endpoint with POST and GET methods allowed and Active status.
Connected APIs list view with methods, status, and edit controls for every endpoint profile.
Endpoint builder step one showing Name, Description, Agent Instructions, a wildcard Base URL pill, and GET and POST method allowlist selections.
Step 1: name the tool, approve base URLs, and allow specific methods.
Endpoint builder step two showing API Key auth type selected with Send As set to X-API-Key and a credential picker panel on the right.
Step 2: choose the auth type and injection target.

Enforced Guardrails

Every Connected API carries the limits that matter at runtime, before any credential is attached.

Secret Never Reaches the Model

The credential is attached only on AgentPMT servers — not inside the agent prompt, context, or memory.

Base URL Allowlist

Forward only to approved base URLs, including sub-path wildcard patterns when needed.

HTTP Method Allowlist

Choose GET, POST, PUT, PATCH, DELETE, or the exact subset the endpoint should accept.

Per-Credential Injection Target

Choose header, body, or query injection and name the value exactly how the upstream API expects it.

Bring your own endpoint

If your API isn't in the marketplace yet, turn it into a Connected API. A few examples of what people connect themselves — or check the marketplace first, we may already have what you need.

SaaS Platforms

CRMs, project tools, and analytics platforms with REST endpoints.

Internal Services

Expose approved microservices and webhooks while keeping internal tokens off the agent.

Data Providers

Weather, market data, geolocation, and any other external data feed.

Payment Gateways

Let agents check balances or prepare actions without handling payment credentials.

Communication Tools

Messaging, notification, and email APIs routed through a controlled proxy.

Developer Tools

CI, cloud, monitoring, and infrastructure services with scoped endpoint access.

Bring whatever auth your API uses

Configure the auth format once. The agent never has to know how the secret is represented — AgentPMT handles it.

Authentication methods supported by Connected APIs
MethodHow AgentPMT handles it
API keysHeader, query, or body — any field name the upstream expects.
Bearer tokensAttached as an Authorization header at request time.
OAuthAccess token injected for protected calls; refresh handled server-side.
Username and passwordEncoded as Basic Auth on the server.
Custom headersAny approved named header for non-standard schemes.

Connected API questions, answered.

Do my API keys ever reach the AI agent?

No. The Credential Vault stores every credential encrypted at rest on AgentPMT servers and injects it server-side at the moment the outbound request leaves for the upstream API. The agent sees the endpoint name and the response, never the raw key, token, or password.

This is enforced by the connected-API builder: every endpoint must select an injection target (header, body, or query parameter) before it can be saved, and the credential value is bound once and never re-emitted to the agent context or the agent memory.

Which HTTP methods can an agent use against a connected API?

You choose the allowed methods per endpoint when you create the connected API: GET, POST, PUT, PATCH, DELETE, or any subset. Requests that use a method outside the allowlist are rejected before the credential is ever attached, so a compromised agent cannot escalate from read to write simply by changing the verb.

You can edit the allowlist on a live endpoint at any time from the Secure API Manager. Changes take effect on the next outbound request.

Connect your first API in under a minute — without sharing the key.

Create a free account, no credit card required. Use a prebuilt connection or add your own endpoint.

Browse Prebuilt Connections