Sign up for Braintrust and keep its API key out of agent context

What this setup unlocks

Use Braintrust for model evaluations, experiments, and traces while Trusty Squire injects the credential only into allowed provider requests.

• Record model traces and experiment results.
• Run repeatable evaluation datasets during development.

What your agent does

These public steps preserve the active registry flow while omitting captured account identifiers, brittle DOM selectors, and literal form values.

1. 01

   navigate

   Open the Braintrust account console.

2. 02

   click oauth button

   Choose google sign-in.

3. 03

   click

   Continue through the account flow.

4. 04

   extract via regex

   Capture the validated credential directly into the vault.

Credential saved to the vault

• BRAINTRUST_API_KEY

  BRAINTRUST_API_KEY is a opaque api_key validated at 8 to 64 characters.

Use it without revealing the provider key

In the Vault, first make api.braintrust.devthe credential's primary allowed host. Then ask your agent to call grant_app_access. It returns a host-scoped egress base URL and a revocable token; the backend uses those values to list Braintrust projects.

// One-time Vault policy: make api.braintrust.dev
// the primary allowed host. Off-allowlist requests are refused.

// Then ask your agent to create a scoped grant:
grant_app_access({
  service: "braintrust",
  rate_limit_per_hour: 100
})

// Inject the returned fields from backend-only secret storage:
// SQUIRE_EGRESS_BASE_URL=<returned base_url>
// SQUIRE_EGRESS_TOKEN=<returned token>

const response = await fetch(
  `${process.env.SQUIRE_EGRESS_BASE_URL}/v1/project?limit=10`,
  {
    headers: {
      Authorization: `Bearer ${process.env.SQUIRE_EGRESS_TOKEN}`,
    },
  },
);

if (!response.ok) throw new Error(`Braintrust returned ${response.status}`);
const projects = await response.json();

Provider request checked against Braintrust API: list projects on 2026-07-15.