OAuth, Turnstile, and Gating an AI Tool the Right Way
The most common AI-tool security mistake is asking the human to paste the thing you most need to protect.
A lot of AI tools ask a user to paste an API token into a chat window so the assistant can act. It is the wrong shape. That token now sits in a transcript, maybe in logs, maybe in a model's context — and it usually grants far more than the task needed. There is a better pattern, and it is not new: OAuth for identity, Turnstile for bots, and secrets that never leave the server.
OAuth: the user authorizes, you never see the token
With OAuth, the user clicks connect, approves scopes on the provider's own screen, and the provider hands your server an access grant. The user never pastes a credential; the model never receives one. Your server stores the grant, and hands the agent a separate, opaque connector key that maps to exactly that one connection. If the key leaks, you revoke it without touching the real token. Store only a hash of the connector key, not the key itself.
The agent should get tools, never the credential behind them.
Turnstile: keep bots off the sensitive doors
Turnstile is a privacy-respecting bot check. The important part most people miss: a sitekey in the page is cosmetic on its own. The token the widget produces must be verified server-side with the secret, and pinned to the expected hostname and action, or the check gates nothing. Put it on the doors that matter — session creation, high-volume submits — not on everything.
Least privilege and no key in the args
Whatever token does exist server-side should be scoped to only what the tools use — read a zone, edit a DNS record, purge cache — never a global key. And a tool should never accept the token as a call argument, where it lands in logs. Secrets belong in managed bindings; the tool reads them from the environment, not from the conversation.
The takeaway
If your AI tool's first step is "paste your API key here," redesign it. OAuth keeps the credential out of the chat, Turnstile keeps bots off the sensitive actions, and scoped server-side secrets keep the blast radius small. The user's job is to click approve — not to hand a model the keys.