> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notte.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# VGS

> Fill VGS aliases in a Notte session through the VGS outbound proxy

> [!TIP]
>
> Read [the Notte skill](https://notte.cc/skill.md) and follow its setup instructions when setting up Notte or building browser automation. This is the shared source for CLI setup, authentication, and the browser-to-code workflow.

VGS stores sensitive data in its vault and gives you aliases in its place. Its [outbound proxy](https://docs.verygoodsecurity.com/vault/http-proxy/outbound-connection) sits between a client and third parties and reveals the real values in transit, following the routes you configure. Use it as a Notte [secret proxy](https://docs.notte.cc/features/sessions/secret-proxies/overview.md): the agent types aliases, and VGS reveals them only on requests to your listed hosts.

## Prerequisites

* A VGS vault holding the data to fill, and its vault ID (it starts with `tnt`).
* Aliases the site's form accepts. For card numbers, the `FPE_6_T_4` alias format keeps the card's format and Luhn check (see [operations](https://docs.verygoodsecurity.com/vault/http-proxy/operations)).
* The hostnames that receive the data: the payment provider or iframe host, not only the merchant's site.

## Configure VGS

1. **Create an outbound route for each host** you will list in `hosts`, with that host as its upstream host. VGS answers requests to a host with no matching route with HTTP 400 ([FAQ](https://docs.verygoodsecurity.com/vault/faq)).
2. **Reveal aliases in requests.** On each route, add a filter in the request phase with a reveal operation that selects the field where the agent types the alias: the form field name for form posts, a JSONPath for JSON bodies, or a regex ([selecting data elements](https://docs.verygoodsecurity.com/vault/http-proxy/operations)).
3. **Redact real values in responses.** On each route, add a filter in the response phase with a redact operation that selects every field where the site can return a real value. VGS then stores the value and returns an alias instead, as in its [card issuing guide](https://docs.verygoodsecurity.com/vault/guides/card-issuing). A response that matches no filter passes through unchanged, so check what each listed host returns. See [why this matters](https://docs.notte.cc/features/sessions/secret-proxies/overview.md#mask-real-values-in-responses).
4. **Get outbound access credentials** under your vault's settings ([access credentials](https://docs.verygoodsecurity.com/vault/http-proxy/outbound-connection/access-credentials)). VGS shows the password only once, when you generate the credentials.
5. **Download the VGS certificate** for your environment (sandbox or live) from the **Code snippets** section of the VGS dashboard.

## Map VGS's values to the secret entry

| Secret entry field | Value |
| - | - |
| `server` | `https://<VAULT_ID>.<ENVIRONMENT>.verygoodproxy.com:8443`, where `<ENVIRONMENT>` is `sandbox` or `live` |
| `username`, `password` | Your outbound access credentials |
| `ca_certificate` | The VGS certificate for that environment (`sandbox.pem` or `live.pem`) |
| `hosts` | The upstream hosts of your outbound routes |

The access credentials do not change per session, so you can [save the configuration in the console](https://docs.notte.cc/features/sessions/secret-proxies/overview.md#save-the-configuration-in-the-console) with the VGS preset and start sessions with `{"type": "secret"}`.

## Example

```python vgs_session.py theme={null}
from pathlib import Path

from notte_sdk import NotteClient
from notte_sdk.types import NotteProxy, ProxySettings, SecretProxy

client = NotteClient()

proxies: list[ProxySettings] = [
    NotteProxy.from_country("us"),
    SecretProxy(
        server="https://tntXXXXXXXXX.sandbox.verygoodproxy.com:8443",
        username="YOUR_VGS_ACCESS_CREDENTIAL_USERNAME",
        password="YOUR_VGS_ACCESS_CREDENTIAL_PASSWORD",
        # The VGS certificate from your dashboard's "Code snippets" section
        ca_certificate=Path("sandbox.pem").read_text(),
        hosts=["api.stripe.com"],
    ),
]

with client.Session(proxies=proxies) as session:
    print(session.session_id)
```

```typescript vgs_session.ts theme={null}
import { readFileSync } from 'node:fs';
import { NotteClient, type SecretProxy } from 'notte-sdk';

const client = new NotteClient();

const vgs: SecretProxy = {
  type: 'secret',
  server: 'https://tntXXXXXXXXX.sandbox.verygoodproxy.com:8443',
  username: 'YOUR_VGS_ACCESS_CREDENTIAL_USERNAME',
  password: 'YOUR_VGS_ACCESS_CREDENTIAL_PASSWORD',
  // The VGS certificate from your dashboard's "Code snippets" section
  ca_certificate: readFileSync('sandbox.pem', 'utf8'),
  hosts: ['api.stripe.com'],
};

await client.Session({ proxies: [{ type: 'notte', country: 'us' }, vgs] }).use(async (session) => {
  console.log(session.getId());
});
```

## Exit IP

VGS's public documentation describes no setting to send outbound traffic through another proxy, so requests to the listed hosts leave from VGS's IP addresses (listed in its [FAQ](https://docs.verygoodsecurity.com/vault/faq)), not from the session's exit. Notte's [shared exit IP](https://docs.notte.cc/features/sessions/secret-proxies/overview.md#share-the-exit-ip) is not available with VGS unless VGS supports an upstream proxy for your vault.

## Learn more

* [VGS outbound routes](https://docs.verygoodsecurity.com/vault/http-proxy/outbound-connection)
* [Filters](https://docs.verygoodsecurity.com/vault/http-proxy/filters) and [operations](https://docs.verygoodsecurity.com/vault/http-proxy/operations)
* [Secret proxies](https://docs.notte.cc/features/sessions/secret-proxies/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.