keyward.broker console
control plane offlineoffline
Documentation

Keyward in five minutes

Your AI agents need API keys — for OpenAI, Stripe, GitHub, whatever. Keyward is where those keys live so your agents never hold them. The agent calls the API through Keyward; Keyward adds the real key server-side, checks it's allowed, and logs it. The key never sits in a .env file, and every use is accountable.

The core idea, concretely

You put a provider's key in Keyward once. From then on, wherever your agent would have called that provider directly, it calls it through Keyward instead — one line. The agent authenticates as itself (a service key), so there's no login or token dance to set up:

your agent / MCP server
import { createClient } from "@keyward.dev/sdk";

const kw = createClient({
  controlPlaneUrl: process.env.KEYWARD_URL,
  agent: "my-mcp",
  agentKey: process.env.KEYWARD_AGENT_KEY,   // no provider key in your code
});

// Same request you'd send OpenAI — but Keyward holds the key:
const res = await kw.gateway("openai", "/v1/chat/completions", {
  method: "POST",
  body: JSON.stringify({ model: "gpt-4o", messages: [{ role: "user", content: "hi" }] }),
});

That's the whole model: keys go in, calls go through, everything is logged. The Quickstart walks the full setup in five minutes.

The differentiator: who authorized this?

The above is an agent acting on its own. When a specific person triggered the action, you pass their identity token instead of the service key — and Keyward records the full user → agent chain on every call (nested for orchestrator → sub-agent, and cryptographically bound so it can't be forged). That's the thing incumbents don't do: every action is traceable to the human who authorized it. It's optional — reach for it when you need per-person accountability, not to get started. (Under the hood it's the OAuth 2.0 Token Exchange sub/act shape, RFC 8693.)

What's in the box

PieceWhat it does
BrokerPOST /v1/credentials — verify user, resolve agent, check policy, mint, audit
Vaultupstream secrets envelope-encrypted at rest; KMS or BYOK per org
Policy enginedeny-by-default rules by agent / provider / scope, per environment
Audit logappend-only allow + deny, exportable (JSON/CSV), SIEM streaming
Consolethis dashboard — audit, agents, secrets, policies, approvals, usage
SDK + CLI@keyward.dev/sdk client with credential caching; keyward init / wrap onboarding

Where to go next

Quickstart wires an MCP server end to end in five minutes. Concepts defines the six words every page uses. SDK and API cover the developer surface. Security model explains the invariants Keyward holds.