> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hasmcp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How does HasMCP inject secrets into API requests automatically?

> Achieving dynamic header reconstruction before executing external REST calls.

# Automatic Secret Injection

Writing custom integration scripts for every external system creates massive overhead and security risks. Engineers frequently struggle to remember which API requires a `Bearer` token header, which uses Basic Auth, and which system demands an `x-api-key` string.

HasMCP fundamentally abstracts this complexity away using **Provider Schemas**.

### The Mapping Logic

When you connect to an external API like Stripe or Github, you construct a generic Provider within the platform.

1. **The Vault Bind**: When configuring the Provider, you select a deeply encrypted secret block, such as `Stripe_Production_Key`.
2. **The Authentication Blueprint**: You instruct HasMCP exactly how Stripe expects to receive this token. For example, you stipulate that the token must be injected natively into the HTTP `Authorization` header, explicitly prefixed by the word `Bearer`.
3. **The Interception**: When the AI Agent prompts the execution of a Stripe Tool block, it sends a purely functional JSON payload (`{"amount": 50}`).
4. **The Translation Phase**: The proxy pauses the payload execution, decrypts the token locally in memory, and stitches together the final raw HTTP request. It dynamically injects the `Authorization: Bearer <token>` string exactly where you diagrammed it.

The connection logic is defined cleanly once during configuration. The AI orchestrator never has to think about HTTP authentication architecture.