PassControl — Keep real API keys out of AI agents<br>Skip to contentPassControl / Agent credential gateway<br>Your AI agents should never hold your real API keys.<br>Give agents cryptographic identity—not the credentials that pay for their calls. PassControl verifies each agent, enforces scope and budget, injects the vaulted provider key, and proxies the request. The key never reaches the agent.<br>Install PassControlnpm · BSL-1.1<br>npm install -g passcontrolCopy
Try the live gateway ↓View source ↗
Agent runtime / credential exposure protected<br>Agent holdsEd25519 passport sign-only private key<br>signs locally<br>Agent never receivessk-proj-••••••••••••••••vaulted
Work-visascope · budget · 05:00<br>Identity travels · provider secrets do not
Source-available Full working core · BSL 1.1<br>Self-hostable Your infrastructure and vault<br>Short-lived access Five-minute scoped work-visas<br>MCP + SDKs Meet agents where they already run
01 / Trust boundary<br>Identity crosses the boundary. Secrets do not.
The passport only signs. A short-lived work-visa carries identity and policy into a gateway that checks every request before resolving a provider credential.
Untrusted agent runtimePassControl security boundaryProvider edge<br>01ED<br>Passport signs<br>The private Ed25519 key signs a one-time challenge locally. It is never sent on the wire.<br>signature(challenge)<br>signed proof<br>02—05Work-visa mintedagent · scope · budget · jti<br>Gateway governs<br>01Verify visa identity + expiry<br>02Check kill switch platform + tenant + agent<br>03Enforce scope provider + model + endpoint<br>04Reserve budget tokens + cost before call<br>KVProvider vault key injected only after ✓
governed request<br>06AI<br>Provider receives<br>PassControl injects the real key in-flight, proxies the call, streams the response, and records the audit.<br>OpenAIAnthropic
Policy order is the security boundaryverify → kill → scope → budget → key → provider
02 / Live keyless demo<br>Feel the control boundary.
This is a synthesized response, clearly marked [demo]. The surrounding pipeline is real: challenge signing, work-visa, scope, budget, audit, and the demo tenant kill switch.
passcontrol / live gateway<br>Keyless demo<br>Agent messageRun governed call<br>Demo tenant kill switchDISARMED Demo tenant accepting requests
Run once, arm the switch, then run the same call again. Disarm to restore it.
Gateway resultstandby<br>responseReady. The demo passport is held server-side.
visa ·scope ·budget ·kill switch ·
✓ Real gateway policy checks✓ No provider call✓ No Vault access✓ Demo-only tenant + scope
03 / Control Tower<br>Control each agent at the gateway.
One inspectable policy boundary for agent identity, credential access, spend, revocation, and the record of every governed call.
KVKeys stay vaulted<br>Real OpenAI and Anthropic credentials are resolved inside the gateway only after a request passes policy. They never enter the agent runtime.
01Token + cost budgets<br>Set both limits per agent. PassControl reserves budget atomically before the provider call, when enforcement can still prevent spend.
×Instant tenant kill switch<br>Stop new requests at the gateway without rotating every provider key or reaching into every running agent process.
LOGControl Tower audit<br>Inspect calls per agent and passport, with provider, model, status, token usage, cost, latency, and request identity in one operator view.
URLDrop-in gateway<br>Keep the OpenAI or Anthropic SDK you already use. Re-point its base URL and pass a work-visa instead of a real provider credential.
MCPNative MCP server<br>Run PassControl as an MCP server for Claude Desktop, Cursor, or Claude Code—the same scope, budgets, audit, and kill switch still apply.
04 / Drop-in adoption<br>Change the route, not the agent.<br>Keep the SDK and call shape you already use. Point the base URL at PassControl and supply the short-lived work-visa where the SDK expects an API key.<br>OpenAI SDKAnthropic SDKClaude DesktopCursorClaude Code<br>Inspect the complete core ↗<br>agent.ts<br>// Same SDK. Governed credential path.<br>const client = new OpenAI({<br>baseURL: "https://your-gateway/api/v1/openai",<br>apiKey: workVisa,<br>});
const response = await client.chat.completions.create({<br>model: "your-model",<br>messages,<br>});MCPpasscontrol mcpsame policy boundary
05 / FAQ<br>Questions, answered honestly.
The short version of what PassControl is, what it protects, and what it does not — no marketing gloss.
What is PassControl?PassControl is a source-available identity and credential gateway for AI agents. Instead of putting your OpenAI or Anthropic key inside an agent, each agent gets a cryptographic identity and a short-lived, scoped token — and the gateway injects the real key only after the request passes policy.<br>Does my agent ever hold my real API key?No. The agent holds a sign-only Ed25519 passport and mints a short-lived work-visa; the gateway resolves the real provider key from a vault and injects it in-flight, then proxies the call. The key never enters the agent runtime.<br>Is PassControl open source?It's source-available under the...