Keep real keys private with Pydantic AI.

Before you start

• pip install pydantic-ai deny-sh requests
• A deny.sh account (free to start), its API key (service access credential) and a vault entry under it (see /dashboard/vault).
• A vault encryption password (VAULT_PW) in your server environment : never the agent prompt.

Simple tool: @agent.tool_plain

Use @agent.tool_plain when the tool needs no dependency injection : just args from the model and the environment. This is the minimal deniable shape.

# pip install pydantic-ai deny-sh requests
import asyncio, os, requests, json
from pydantic_ai import Agent
from deny_sh import vault_get

agent = Agent(
    'openai:gpt-5.4',
    system_prompt="You are a billing assistant.",
)

@agent.tool_plain
def get_invoice(invoice_id: str) -> str:
    """Look up a Stripe invoice by id. Returns status and amount due."""
    # resolve credential INSIDE the tool boundary
    stripe_key = vault_get("stripe-prod", os.environ["VAULT_PW"])
    r = requests.get(
        f"https://api.stripe.com/v1/invoices/{invoice_id}",
        headers={"Authorization": f"Bearer {stripe_key}"},
    )
    body = r.json()
    # narrowed DTO: key never reaches the LLM context
    return json.dumps({"id": body.get("id"), "amount_due": body.get("amount_due"),
        "status": body.get("status")})

async def main():
    result = await agent.run("Look up invoice in_1Abc123XYZ")
    print(result.output)

asyncio.run(main())

Multiple customers: @agent.tool + dependency injection

Keep each customer’s service keys out of agent conversations. Pydantic AI’s deps_type is purpose-built for this. Define a @dataclass Deps holding the per-customer vault password and deny.sh API key, declare it on the Agent, and Pydantic AI injects it into every @agent.tool call via RunContext. Keep request-specific credentials separate. Each request carries exactly its tenant's credentials.

import asyncio, requests, json
from dataclasses import dataclass
from pydantic_ai import Agent, RunContext
from deny_sh import vault_get

@dataclass
class Deps:
    tenant_pw: str       # per-tenant vault wrap password
    deny_api_key: str    # per-tenant deny.sh API key

agent = Agent(
    'openai:gpt-5.4',
    deps_type=Deps,
    system_prompt="You are a billing assistant.",
)

@agent.tool
async def get_invoice(ctx: RunContext[Deps], invoice_id: str) -> str:
    """Look up a Stripe invoice by id. Returns status and amount due."""
    # deps carry per-tenant credentials; no global fallback possible
    stripe_key = vault_get(
        "stripe-prod",
        ctx.deps.tenant_pw,
        api_key=ctx.deps.deny_api_key,
    )
    r = requests.get(
        f"https://api.stripe.com/v1/invoices/{invoice_id}",
        headers={"Authorization": f"Bearer {stripe_key}"},
    )
    body = r.json()
    # narrowed DTO: only the fields the model needs
    return json.dumps({"id": body.get("id"), "amount_due": body.get("amount_due"),
        "status": body.get("status")})

async def handle_request(user_msg: str, tenant_pw: str, deny_api_key: str):
    deps = Deps(tenant_pw=tenant_pw, deny_api_key=deny_api_key)
    result = await agent.run(user_msg, deps=deps)
    return result.output

# per-request invocation :  each tenant gets its own deps
asyncio.run(handle_request(
    "Look up invoice in_1Abc123XYZ",
    tenant_pw="tenant-vault-password",
    deny_api_key="dk_live_...",
))

Production-scale notes

For high-throughput deployments, a few patterns apply directly on top of the multi-tenant shape above.

• The Agent instance is safe to share across requests : it holds no credential state. Instantiate once at module level; build a fresh Deps per request.
• For FastAPI / Starlette, extract the tenant's deny_api_key and tenant_pw from your auth middleware and pass them as Deps into agent.run() inside the route handler.
• Each tenant's vault entries are independently encrypted. A compromise of one tenant's vault password does not affect other tenants' entries.
• For parallel tool calls (Pydantic AI supports concurrent tool execution), each concurrent @agent.tool invocation receives the same RunContext : credentials are injected correctly regardless of concurrency.
• Use agent.run_sync() as a convenience wrapper in synchronous contexts, but prefer await agent.run() inside an async framework to avoid blocking the event loop during the vault round-trip.

Troubleshooting

The first five errors a launch-day developer hits with this stack. Click to expand the fix.

Production checklist

• Set up /dashboard/decoy-alerts with a SHA-256 of a decoy controlData. Receive alerts when a registered fingerprint reaches our monitored decryption endpoint, not merely when a value is copied.
• Wire /dashboard/webhooks to your existing Datadog / PagerDuty / Slack.
• Pull audit-chain receipts via GET /v1/audit/receipt/<id> or browse them at /dashboard/audit for reviewable evidence of recorded activity.
• Use /dashboard/byok if you need customer-managed KMS keys.