Building Managed Agents That Use GitHub Without Exposing Your Token

A technique for running the GitHub CLI inside Gemini API Managed Agents without exposing your GitHub Personal Access Token (PAT). The approach uses a dummy token inside the sandbox while an egress proxy intercepts outbound requests and replaces the dummy token with the real PAT in the Authorization header. The real token never enters the sandbox, staying in the control plane. The post covers setting up fine-grained PATs, configuring network allowlists with header transformations for both API and Git auth schemes, and creating persistent agents that reuse environments to avoid reinstalling the gh CLI on every call.