1Password has had vaults for a very long time now. You can also key API credentials specifically to a vault. I've been letting agents access _their own_ vault for awhile.