Credential-injecting forward proxies for AI agents

Stop baking secrets
into your agents.

CIFP is a multi-tenant SaaS proxy that injects real credentials at the wire level. Configure secrets through a Vercel-style dashboard, send requests with {$TOKEN} placeholders, and let CIFP handle the rest.

Auto-auth injection

Send requests with {$TOKEN} placeholders. CIFP swaps in real credentials before forwarding — no secret ever touches your agent code.

Firewall mode (MITM)

Full TLS interception with a per-proxy CA. Every request is evaluated by a CEL rule set before credentials are injected.

Encrypted secret vault

AES-256-GCM encrypted secrets stored per proxy. Secrets are never returned over the API and never written to Squid config.

CEL rule engine

Write expressive allow/deny/HITL rules in Google CEL. Rules are compiled at save-time so you get errors immediately, not at runtime.

Isolated Fly.io machines

Each proxy runs on a dedicated Fly.io machine in your chosen region. Pause, resume, or delete machines via API or dashboard.

Multi-tenant, API-driven

Full REST API for proxy lifecycle management. Manage secrets, firewall rules, and access logs from your own tooling.

Ready to ship safer agents?

Start with a proxy in under two minutes. Powered by Whop.

View plans