Building Managed Agents That Use GitHub Without Exposing Your Token

This article explains how to run the GitHub CLI (gh) inside a Gemini API Managed Agent without exposing your GitHub Personal Access Token (PAT) to the sandbox environment. It describes the use of a dummy token locally and an egress proxy that intercepts outbound requests to api.github.com or github.com, replacing the dummy token with the real token in the Authorization header. The real token remains in the control plane and never enters the sandbox. Prerequisites include a Gemini API Key and a fine-grained GitHub PAT. A Python example demonstrates spinning up an agent, configuring network allowlist with header transformations, and running gh commands securely. This is relevant to IT/TECHNOLOGY as it covers secure API usage, DevOps practices, and cloud-based agent management.