Fine-grained access for every API your agents touch.
Give each agent its own key and decide, action by action, what it may do on Gmail, QuickBooks, GitHub, Cloudflare and almost any other API.
| Permission | Access | Only when |
|---|---|---|
Messages · Send messages.send | Allowed | Every recipient is one of alice@hollis-cpa.com, ben@hollis-cpa.com |
Messages · Send messages.send | Ask meWaits up to 24 hours | Any request |
Drafts · Create drafts.create | Allowed | Any request |
Messages · Read messages.read | Allowed | Everyone is one of *@acme.dev, *@hollis-cpa.com |
Messages · Trash messages.trash | Ask meWaits up to 24 hours | Any request |
Approve requests on your phone.
KeyContain holds an Ask me request and notifies you in the KeyContain app or your browser, with its own summary of what the request does.
- AllowedRoutine requests go straight to the service.
- Ask meRisky ones wait for your approval.
- No rowEverything else is refused with a message your agent understands.
Give your agent only the access it needs.
QuickBooks Online
Its own connection
An app connected to a company can read and change everything in it, from invoices to payments and bills.
Your KeyContain key
You let it read invoices, customers and reports, and have new invoices wait for your approval.
GitHub
Its own token
A token that can push to a repository can push to, force-push and delete any of its unprotected branches.
Your KeyContain key
You let it push to agent/-prefixed branches in the repositories you pick and open pull requests. Merges wait for you.
Cloudflare
Its own token
A token that can edit DNS in a zone can change or delete every record in it.
Your KeyContain key
You have every DNS change wait for your approval.
How your keys are stored
Every service key (e.g. QuickBooks) you give KeyContain is stored encrypted so that you can't use it even if you have a copy of our database or backups.
- Encrypted
- Each service key is encrypted with a key of its own. We don't store the decryption key.
- Unlocked only when used
- A service key is unlocked only briefly when you make a request, only stored in memory, and immediately purged after use.
- Kept out of logs
- Keys never appear in KeyContain's logs.
Free to start.
Free allowance
- 10 requests per minute
- 100 MB of traffic per month
- Shared across unlimited keys and services
Capacity units
| Units | Requests per minute | Traffic per month | Per month |
|---|---|---|---|
| 1 | 50 | 1 GB | $0.50 |
| 4 | 200 | 4 GB | $2.00 |
| 20 | 1,000 | 20 GB | $10.00 |
- Shared across unlimited keys and services
Works with the services you already use.
Want built-in support for a service we don't have yet? Let us know →