# Connect pro-code agents to external systems

:::callout{theme="neutral"}
Connecting pro-code agents to external systems using sources is not supported on [CBAC-enabled environments](../../security/classification-based-access-controls/index.md).
:::

When your pro-code agent needs to reach an external system (such as a monitoring service, a webhook, or a third-party API), or requires a secret like an API key or token, use a [source](../../data-connection/core-concepts/index.md#sources).

A source provides two things to your pro-code agent at runtime:

* **Network egress** to the host the source points to. Sources contribute network policies automatically, so you do not need to configure egress separately.
* **Secrets** delivered into the running agent container at `/app/var/run/source_credentials.json`.

## Read source credentials

Foundry writes resolved secrets to `/app/var/run/source_credentials.json`. The file has the following shape:

```json
{
  "<sourceApiName>": {
    "<secretApiName>": "<secret value>"
  }
}
```

Read it from your agent code:

```typescript
import * as fs from "fs";

type SourceCredentials = Record<string, Record<string, string>>;

const creds: SourceCredentials = JSON.parse(
  fs.readFileSync("/app/var/run/source_credentials.json", "utf-8"),
);

const externalSystemApiKey = creds["example"]?.["api_key"];
```

Keep the following in mind when reading credentials:

* The file contents will be `{}` if the credentials could not be resolved.
* Do not cache the file contents in memory. The file is replaced atomically (as a single, indivisible operation, with no partial or intermediate state visible), so read it when you need the current value.

## Next steps

* [Configure OSDK and Ontology MCP connections in your agent code.](../agent-templates/index.md)
* [Publish and call a pro-code agent.](../publish-and-call/index.md)