AgentKey: Secure access governance for AI agents
Centralized, approval-based API key management for AI agents that eliminates hardcoding and scattered .env files Uses AES-256-GCM encryption for credential storage and communication security
liveAgentKey
AgentKey addresses a critical pain point for developers deploying AI agents: secret management. Instead of the traditional approach of embedding API keys directly into agent code or scattering them in untracked .env files, this system introduces a runtime access model where agents request credentials from a central interface. The approval workflow design is clever - requiring explicit administrator authorization for each access request maintains oversight while avoiding the need to predefine static credentials in agent binaries.
The HTTP-based API authentication model is straightforward for integration with existing agent implementations using OpenAI, Vercel or any HTTP-capable framework. The request approval process is particularly useful for multi-tenant environments where different agents may need varying levels of access to enterprise tools. For example, the sample scenario shows a devops agent requesting GitHub access credentials specifically for PR creation, with the admin able to enforce scope-specific permissions rather than blanket access.
A notable implementation detail is the use of AES-256-GCM for encryption at rest. This choice provides both confidentiality and integrity guarantees for the sensitive credentials, which is a significant improvement over basic environment variable storage. The source-available model (BSL-1.1 license) enables verification of the self-hosted solution through GitHub, though the license restricts use to single-organization deployments.
The free tier model dramatically lowers the entry barrier for teams looking to modernize their credential management strategy. However, enterprise users should evaluate the platform's role federation capabilities - while approval per request is secure, it may create bottlenecks compared to token-based systems that can self-expire. Security teams and software architects building CI/CD pipelines or SOC tools for agents will find particular value in the centralized approval and revocation capabilities.