> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Plane

> Run tool execution inside your own network so resolved secrets never reach Danube

<Note>
  **Early access.** The data-plane agent is available to organizations on request. Contact us at [danubeai.com/contact-sales](https://danubeai.com/contact-sales) to enable it.
</Note>

The data-plane agent is a small container that runs **inside your network** and executes tools for your organization's `local_only` services. Danube's control plane keeps doing policy, routing and audit, but it never makes the credentialed call and never receives your secrets. It queues an un-credentialed dispatch (tool definition, parameters, and credential *references*); the agent resolves the references locally, makes the call, and reports the outcome back.

## Quick start

<Steps>
  <Step title="Generate an enrollment token">
    Go to [Dashboard > Organization > Data Plane](https://danubeai.com/dashboard/organization/dataplane) and click **Generate enrollment token**. Tokens are valid for one hour and single use. Admins and owners only.
  </Step>

  <Step title="Run the agent">
    ```bash theme={null}
    docker run -d \
      --name danube-dataplane \
      -v danube-dataplane-data:/data \
      -e DANUBE_ENROLL_TOKEN=<your-enroll-token> \
      -e DANUBE_API_URL=https://api.danubeai.com \
      danubeai/dataplane-agent:latest
    ```

    On first boot the agent exchanges the token for a durable identity (an agent id and secret) persisted in the `/data` volume. Restarts reuse it; the token is not needed again.
  </Step>

  <Step title="Confirm it is connected">
    The agent appears in the Data Plane page with its name and `last_seen_at`. Revoke it from the same page at any time; a revoked agent is rejected on its next request.
  </Step>

  <Step title="Store credentials as references">
    Data-plane execution needs credentials stored as references, not values: `env://VAR_NAME` for an environment variable on the agent's host, or `vault://<mount>/<path>#<field>` for HashiCorp Vault (KV v2). A credential held only as a value in Danube is never shipped to the agent; the dispatch fails with an error telling you to re-store it as a reference.
  </Step>
</Steps>

## Configuration

| Variable                          | Default                    | Purpose                                              |
| --------------------------------- | -------------------------- | ---------------------------------------------------- |
| `DANUBE_API_URL`                  | `https://api.danubeai.com` | Danube control-plane base URL                        |
| `DANUBE_ENROLL_TOKEN`             |                            | One-time enrollment token (first boot only)          |
| `DANUBE_AGENT_STATE_PATH`         | `/data/agent-state.json`   | Persisted identity, audit sequence, and retry buffer |
| `DANUBE_AGENT_NAME`               |                            | Display name shown in the dashboard                  |
| `DANUBE_BUDGET_STALENESS_SECONDS` | `900`                      | Fail-closed threshold for the local spend snapshot   |
| `VAULT_ADDR`, `VAULT_TOKEN`       |                            | HashiCorp Vault for `vault://` references            |

## Security model

* **Secrets never leave your network.** Dispatches carry credential references only. The agent resolves them in-process at call time.
* **Signed requests.** Every agent request is authenticated with HMAC-SHA256 over the method, path, timestamp, nonce and body hash, using the agent secret. Requests with more than 300 seconds of clock skew, or a reused nonce, are rejected.
* **Revocation.** An admin can revoke an agent at any time.
* **Spend limits fail closed.** The agent syncs your organization's API key spend caps and enforces them before each call. If its snapshot is older than the staleness threshold and cannot be refreshed, execution is denied, not allowed.
* **Audit stream.** Every execution and denial is sent to the [audit log](/organizations/audit-log) with a per-agent sequence number, buffered and retried, and ingested idempotently.

## Limits in this release

* Supported credential injection: bearer or HTTP auth header, API key header, API key query parameter.
* One in-flight dispatch per agent; run several agents for throughput.
* The control plane waits 60 seconds for an agent to complete a dispatch before marking it expired.

## Operations

* Logs go to stdout: `docker logs danube-dataplane`.
* Graceful shutdown on `SIGTERM` or `SIGINT`: the in-flight dispatch finishes and the audit buffer is flushed.
* Network errors back off exponentially, from 1 second to a 60 second cap.