I Let My AI Agent Create Its Own Databases. Here’s How the Passwords Stay Locked Up

Description and use

An AI agent provisions Postgres or Redis databases via a single API call, with credentials encrypted at rest and only exposed through controlled endpoints, eliminating manual password handling.

Problem

Managing database credentials manually leads to passwords residing in multiple insecure locations such as .env files, chat logs, and dashboards.

Outcome

A single API call creates a fully‑functional Postgres or Redis database, encrypts credentials at rest, and allows an AI agent to wire the database into an application without exposing passwords to humans or logs.

Workflow

• 1. Deploy the agentic-hosting (ah) service on a Linux server.
• 2. Provide the agent with the ah API endpoint and key via a link to llms.txt.
• 3. Agent sends a POST /v1/databases request with name and type (postgres or redis).
• 4. ah pulls the appropriate Docker image, starts a container, and waits for readiness (≈30s).
• 5. ah returns a 201 response containing id, name, type, status, host, port, db_name, username, and connection_string.
• 6. Agent retrieves the connection string via GET /v1/databases/{id}/connection-string (audit logged).
• 7. Agent sets the DATABASE_URL (or REDIS_URL) environment variable on the target service via POST /v1/services/{id}/env.
• 8. Agent restarts the service via POST /v1/services/{id}/restart to apply the new env and connect to the database.
• 9. ah stores the password and full connection string encrypted with AES‑256‑GCM using a server master key.
• 10. Credentials are never logged beyond the audit entry and are not exposed in GET /v1/databases responses.

Evidence

By the end of that, the password lived in four places, and I'd chosen none of them on purpose.

Source

One request creates a database. The type is postgres or redis:

Source

ah pulls the image (postgres:16-alpine or redis:7-alpine), starts a container, and then checks readiness by speaking the database's own protocol, not just by seeing an open port.

Source

Before anything is saved, ah encrypts both the password and the full connection string with AES-256-GCM, using the server's master key.

Source

Every call to that endpoint writes an audit line to the server log with the tenant, the database, and the ID of the API key that asked.

Source