# Sandboxed AI bots: give capabilities, not credentials

DevFeed: [Sandboxed AI bots: give capabilities, not credentials](<https://devfeed.tech/articles/sandboxed-ai-bots-give-capabilities-not-credentials-30713.md>)

Original publisher: [Read original article](<https://www.windmill.dev/blog/discord-bot-stripe-sandboxed-ai>)

Author: Alex Petric

Published: 2026-04-23T00:00:00Z

Content type: tutorial

Language: en

Sources: [Windmill Blog](<https://devfeed.tech/sources/windmill-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Discord](<https://devfeed.tech/topics/discord.md>), [Discord bot](<https://devfeed.tech/topics/discord-bot.md>), [stripe](<https://devfeed.tech/topics/stripe.md>), [implementation](<https://devfeed.tech/topics/implementation.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>), [HashiCorp Vault](<https://devfeed.tech/topics/hashicorp-vault.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-bots](<https://devfeed.tech/tags/ai-bots.md>), [ai-discord-websocket-triggers](<https://devfeed.tech/tags/ai-discord-websocket-triggers.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [discord](<https://devfeed.tech/tags/discord.md>), [secret-storage](<https://devfeed.tech/tags/secret-storage.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [stripe](<https://devfeed.tech/tags/stripe.md>), [websocket](<https://devfeed.tech/tags/websocket.md>), [websocket-triggers](<https://devfeed.tech/tags/websocket-triggers.md>)

## AI overview

This tutorial shows how to build a Discord bot that answers billing questions through Stripe while keeping API keys hidden from an AI agent. Windmill tools retrieve credentials at runtime from encrypted resource storage, and the agent receives only tool capabilities. The sandbox also provides process, filesystem, CPU, memory, and optional network isolation.

## Source excerpt

How do I build an AI Discord bot that accesses Stripe without leaking API keys? Use Windmill sandboxed tools to give the AI capabilities, not credentials.