# Credentials proxy

With the proxy on, a sandbox holds a placeholder rather than a real key. The broker swaps in the secret on the way out, and only for the host its rule names.

```sh
harebox ai profile new --name default --make-default true
harebox ai key set default anthropic-api-key --value sk-example
harebox proxy set --enabled true --profile default
harebox proxy rule add --secret-ref anthropic-api-key --host api.anthropic.com --header x-api-key --template "{secret}"
harebox proxy rules
```

| Check | Result |
|---|---|
| Placeholder used outside HareBox | Worthless |
| Sandbox deleted | Placeholder stops working |
| Sandbox blocked with `harebox ai block` | Refused |
| A host with no rule | Refused |
| A provider echoes the request | The secret is removed from the reply |

The proxy costs $1 for each UTC day it's on, plus $1 per 1,000 requests, paid from the wallet. It charges while your sandboxes are stopped, too, so turn it off when you don't need it.

**The limit:** a guest can still use a proxied secret while its placeholder is valid. Rules narrow what it can do, but they don't remove the risk.

**Consumer logins:** proxying Claude or ChatGPT subscription sign-ins may conflict with provider terms, so it isn't built, pending legal review.