Give your sandboxed agents API keys they can't read(github.com)

API keys set as environment variables in a sandbox are readable by the agent. Superserve Secrets keeps the real credential out of the sandbox. Your code uses a stand-in token that's swapped for the real key as the request leaves the host.