v0 pipes every Snowflake call through a TLS-terminating proxy so generated code never touches the OAuth token.

The sandbox firewall forwards requests to a v0 proxy using a per-sandbox certificate authority, so the proxy reads the traffic, verifies the sandbox's OIDC token, resolves the chat session, and fetches a fresh credential server-side. Critically, it injects credentials only into protocol-defined fields (the Authorization bearer header, the login request's token field) and rejects any request where the placeholder appears elsewhere, because blind substitution would leak the token back through query results. Vercel First 15 days: ~13,000 requests, zero placeholder-misuse rejections. If you're generating code that calls authenticated APIs, this is the pattern to copy rather than invent.