Agentkeygate

AgentKeyGate

Give your agent a pass for 20 calls and 10 minutes. Your AI agent shouldn't know your API keys.

Quick start · MCP · Skill · FAQ · agentkeygate.com · Русский

AgentKeyGate is a free, self-hosted gateway that gives AI agents short-lived, owner-approved passes to APIs instead of the API keys. The agent asks for access and says why. You approve it in Telegram or on the web. The gateway adds your key to each call, counts the calls, filters what comes back, and closes the pass when the time or the calls run out. The agent never sees the key.

It is for people who run Claude Code, Codex, Cursor, Hermes, OpenClaw or their own scripts against a real CRM, payment, email or LLM account and do not want a long-lived key in every agent's config.

What you get

• The key stays on your server. Keys are encrypted at rest, in AWS SSM Parameter Store or an encrypted file vault. Agents get passes (gwt_...), never keys. Key values never appear in logs, URLs, responses or errors.
• A pass is limited by time and by calls. Each pass has a TTL, a maximum number of calls and a parallelism limit. There is also a per-agent rate limit.
• You approve with the facts in front of you. The request shows the agent, the service, the time, the number of calls and the agent's reason. Approve in Telegram or on the web; Slack and e-mail can notify you.
• You decide what comes back from your CRM. CRM and support keys are read-only by default. You pick data types and fields, the gateway cuts the rest from the response and can mask e-mails, phone numbers, card numbers and IBANs.
• One kill switch. Revoke a pass, an agent or everything at once. It takes effect on the next call.
• An audit log. Requests, approvals, calls, blocked calls and logins go to an append-only log. The Activity page counts every call, including the ones the filter blocked.

How does it work?

sequenceDiagram

participant A as Agent participant G as AgentKeyGate (your server) participant O as You (Telegram / web) participant S as Service API A->>G: request access: service, 10 min, 20 calls, reason G->>O: notification with the facts O->>G: approve G-->>A: pass gwt_... (not the key) A->>G: /v1/proxy/ /... with the pass G->>S: same call + your key S-->>G: response G-->>A: filtered response, call counted

1. An agent needs an API, for example Bitrix24. It asks the gateway for access with a TTL, a call limit and a reason: "Weekly report: leads that changed status since Monday".
2. You get a notification in Telegram, Slack or e-mail. You approve in Telegram or on the web, or a standing policy approves it.
3. The agent receives a pass. It calls /v1/proxy/bitrix24/... with it. The gateway adds your key, forwards the call and counts it.
4. After 20 calls or 10 minutes (the numbers are an example) the pass stops working.

Quick start

VPS (Debian 12, Ubuntu 24.04)

Point a DNS A record at the server, then run:

curl -fsSL https://raw.githubusercontent.com/maximskorohod/agentkeygate/v1.0.2/scripts/setup.sh -o setup.sh

echo "e0ddced59b9c360681161e300232726c32b49fb5f39ee8686765b2971faec2fc setup.sh" | sha256sum -c - sudo bash setup.sh --domain gw.example.com

The default vault is AWS SSM, which needs an instance role. Outside AWS, add --vault file.

The script installs Node.js 22, Caddy (automatic TLS) and systemd services, and prints a one-time setup link (valid 15 minutes). Open it to set the owner password, turn on 2FA and connect Telegram or Slack. Backups and restore: docs/DEPLOY.md.

On your machine (npm)

Requires Node.js 22.

npm ci

GW_VAULT=file node bin/gateway.js init # prints the one-time setup link node bin/gateway.js start # http://127.0.0.1:8080 npm test

After the setup wizard the site opens /welcome with a card for each agent client below. A Docker setup is described in docs/DEPLOY.md; it has not been tested with a real certificate.

Connect your agent (MCP)

Create an agent in the web UI (Agents). The agent token (gwa_...) is shown once. Each card on /welcome creates the agent and prints the snippet for that client. Snippets keep the token out of the config where the client supports environment variables (AGENTKEYGATE_TOKEN) or a hidden input.

Checked live says whether the snippet has been verified against the running client. no means it follows the client's documentation and has not been verified yet.

Example for Claude Code:

claude mcp add --transport http agentkeygate https://gw.example.com/mcp \

--header "Authorization: Bearer $AGENTKEYGATE_TOKEN"

The MCP endpoint is listed in the Official MCP Registry format in server.json: https://{host}/mcp with a bearer token, where {host} is your own gateway.

Use it as a skill

Agents that load Agent Skills can use skills/agentkeygate instead of MCP. The helper script gw.sh needs curl and jq. It reads AGENTKEYGATE_URL and AGENTKEYGATE_TOKEN from the environment.

Services

In the catalog (providers.yaml): OpenAI, Anthropic, Google Gemini, OpenRouter, Groq, Mistral, GitHub, Slack, Notion, Linear, Stripe, HubSpot, Pipedrive, Zendesk, Atlassian (Jira and Confluence Cloud), Airtable, Resend, SendGrid, Twilio, Deepgram, ElevenLabs, Telegram Bot API, Bitrix24 (cloud and self-hosted), amoCRM, and Other: any public HTTPS API that takes a key in a header you name.

Data filter

For services that support it, the owner limits what an agent sees. The filter works on the response, so it applies to every agent that uses the key.

• Data types and fields. Pick types (for example Deals) and fields inside them. Everything else is cut from the JSON answer before it reaches the agent. Methods and routes outside the chosen types return 403.
• Read only (`readOnly`). Only reads pass. For REST services that means GET and HEAD, plus listed search routes. For Bitrix24 and Telegram it means a list of read methods. Writes return 403 write_not_allowed and do not use up the quota. On by default for CRM and support keys (HubSpot, Pipedrive, Zendesk, Bitrix24, amoCRM).
• Mask (`mask`). Replaces e-mail addresses, phone numbers with + or separators, bank card numbers (Luhn check) and IBANs in all string values of a JSON answer with ****. Names are not detected. A bare string of digits without + or separators is not masked, because it looks the same as an ID or an amount.
• Weakening needs fresh 2FA. Turning off readOnly or mask, adding a type, a field or a flag asks for a new TOTP code, then shows a "was, now" page before the change applies.
• REST routes. For REST services a rule is an HTTP method plus a route, such as GET /crm/v3/objects/deals/:id. Search is a separate flag per type. Batch and export routes stay closed.
• Check on one call. On the key's filter page, "Check on one call" makes one real read request as the owner (outside the agents' limits, written to the audit log) and shows field names only, never values.
• What the agent knows. The approval answer and the requests list carry a filter object (types, open methods, read_only, mask), so the agent can plan its calls.

Filters exist for Bitrix24, HubSpot, Pipedrive and Zendesk. The HubSpot and Pipedrive fields have been checked against live accounts. The Zendesk fields come from the provider's documentation (marked unverified in providers.yaml). Run "Check on one call" after you save.

Example, Bitrix24 crm.lead.list with a field filter:

// the service returns

{ "ID": "4182", "TITLE": "Anna Lee, website redesign", "STATUS_ID": "IN_PROCESS", "OPPORTUNITY": "12400.00", "NAME": "Anna", "PHONE": [{ "VALUE": "+1 415 555 0134" }], "COMMENTS": "Asked for a discount" } // the agent gets { "ID": "4182", "STATUS_ID": "IN_PROCESS", "OPPORTUNITY": "12400.00" }

How is it different?

Other projects also keep keys away from agents. This is what each one says on its own pages, checked on 7 November 2026. "Not described" means we did not find it there.

Compared with a key in .env: the agent can read the file, a prompt injection can ask it to send the key elsewhere, and the key keeps its full rights for as long as it lives.

API reference

REST: request a pass, poll, call through the proxy

Request access. ttl is in seconds (300 to 86400, capped by the key's limit). reason is up to 200 characters and is shown to the owner.

curl -s -X POST https://gw.example.com/v1/grants \

-H "Authorization: Bearer $AGENT_TOKEN" -H "Content-Type: application/json" \ -d '{"provider":"gemini","ttl":600,"calls":20,"reason":"Summarize the 14 support tickets from today"}'

• 200 {"status":"approved","token":"gwt_...","expires_at":...,"max_calls":20}: approved immediately (the key's policy allows it).
• 202 {"status":"pending","request_id":"...","poll_after":5}: waiting for the owner.
• 403: denied by policy