{"slug": "show-hn-passcontrol-so-your-ai-agents-never-hold-your-real-api-keys", "title": "Show HN: PassControl – so your AI agents never hold your real API keys", "summary": "PassControl, a source-available identity and credential gateway for AI agents, lets developers give agents cryptographic identity instead of real API keys, enforcing scope, budget, and revocation without exposing provider credentials to the agent runtime. The gateway proxies requests to OpenAI, Anthropic, Groq, Mistral, Together, and DeepSeek, and is available as v0.4.x under the Business Source License 1.1.", "body_md": "**Ed25519 passport**\n\n`sign-only private key`\n\n`sk-proj-••••••••••••••••`\n\nvaultedPassControl / Agent credential gateway\n\n**Give agents cryptographic identity—not the credentials that pay for their calls.** PassControl verifies each agent, enforces scope and budget, injects the vaulted provider key, and proxies the request. The key never reaches the agent.\n\n`npm install -g passcontrol`\n\n`sign-only private key`\n\n`sk-proj-••••••••••••••••`\n\nvaulted01 / Trust boundary\n\nThe passport only signs. A short-lived work-visa carries identity and policy into a gateway that checks every request before resolving a provider credential.\n\n02 / Live keyless demo\n\nThis is a synthesized response, clearly marked `[demo]`\n\n. The surrounding pipeline is real: challenge signing, work-visa, scope, budget, audit, and the demo tenant kill switch.\n\nRun once, arm the switch, then run the same call again. Disarm to restore it.\n\nReady. The demo passport is held server-side.\n\n03 / Control Tower\n\nOne inspectable policy boundary for agent identity, credential access, spend, revocation, and the record of every governed call.\n\nReal OpenAI and Anthropic credentials are resolved inside the gateway only after a request passes policy. They never enter the agent runtime.\n\nSet both limits per agent. PassControl reserves budget atomically before the provider call, when enforcement can still prevent spend.\n\nStop new requests at the gateway without rotating every provider key or reaching into every running agent process.\n\nInspect calls per agent and passport, with provider, model, status, token usage, cost, latency, and request identity in one operator view.\n\nKeep the OpenAI or Anthropic SDK you already use. Re-point its base URL and pass a work-visa instead of a real provider credential.\n\nRun PassControl as an MCP server for Claude Desktop, Cursor, or Claude Code—the same scope, budgets, audit, and kill switch still apply.\n\n04 / Drop-in adoption\n\nKeep the SDK and call shape you already use. Point the base URL at PassControl and supply the short-lived work-visa where the SDK expects an API key.\n\n``` js\n// Same SDK. Governed credential path.\nconst client = new OpenAI({\n  baseURL: \"https://your-gateway/api/v1/openai\",\n  apiKey: workVisa,\n});\n\nconst response = await client.chat.completions.create({\n  model: \"your-model\",\n  messages,\n});\n```\n\n`passcontrol mcp`\n\nsame policy boundary05 / FAQ\n\nThe short version of what PassControl is, what it protects, and what it does not — no marketing gloss.\n\nPassControl is a source-available identity and credential gateway for AI agents. Instead of putting your OpenAI or Anthropic key inside an agent, each agent gets a cryptographic identity and a short-lived, scoped token — and the gateway injects the real key only after the request passes policy.\n\nNo. The agent holds a sign-only Ed25519 passport and mints a short-lived work-visa; the gateway resolves the real provider key from a vault and injects it in-flight, then proxies the call. The key never enters the agent runtime.\n\nIt's source-available under the Business Source License 1.1 — the full working core is free to inspect and self-host, but it is not an OSI open-source license. The plan is open-core: paid hosting and an accountability layer come later.\n\nIt's early (v0.4.x), built solo, and not yet independently audited — run it against a non-critical key first. It is built security-first (RLS on every table, a single service-role-only decrypt path, an append-only audit log, tenant-isolation tests), but test-covered and careful is not the same as audited.\n\nOpenAI, Anthropic, Groq, Mistral, Together, and DeepSeek today. Because it is a drop-in gateway, you keep your existing SDK and just point its base URL at PassControl.\n\nThose center on routing, caching, and observability behind a shared key. PassControl centers on per-agent cryptographic identity, capability scoping, per-agent budgets, and instant revocation — and it runs drop-in alongside them.\n\nNo — the agent does not hold the visa. A local sidecar mints and auto-refreshes it (and re-mints instantly on a 401), so a multi-hour session never times out mid-task while revocation stays near-instant. A single long streaming call is verified once at the start and finishes regardless.\n\nSource-available / Self-host\n\nRun the complete PassControl core on your own infrastructure and inspect every line in the credential path.\n\nEarly (v0.4.x), built in the open, not yet independently audited — run it against a non-critical key first. [Security policy ](https://github.com/Vertias3u/PassControl/blob/main/SECURITY.md)", "url": "https://wpnews.pro/news/show-hn-passcontrol-so-your-ai-agents-never-hold-your-real-api-keys", "canonical_source": "https://passcontrol.vertias.eu", "published_at": "2026-07-29 12:09:41+00:00", "updated_at": "2026-07-29 12:22:46.490406+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "developer-tools"], "entities": ["PassControl", "OpenAI", "Anthropic", "Groq", "Mistral", "Together", "DeepSeek"], "alternates": {"html": "https://wpnews.pro/news/show-hn-passcontrol-so-your-ai-agents-never-hold-your-real-api-keys", "markdown": "https://wpnews.pro/news/show-hn-passcontrol-so-your-ai-agents-never-hold-your-real-api-keys.md", "text": "https://wpnews.pro/news/show-hn-passcontrol-so-your-ai-agents-never-hold-your-real-api-keys.txt", "jsonld": "https://wpnews.pro/news/show-hn-passcontrol-so-your-ai-agents-never-hold-your-real-api-keys.jsonld"}}