Agent holdsEd25519 passport
sign-only private keyAgent never receives
sk-proj-••••••••••••••••vaultedPassControl / Agent credential gateway
Your AI agents should never hold your real API keys.
Give agents cryptographic identity—not the credentials that pay for their calls. PassControl verifies each agent, enforces scope and budget, injects the vaulted provider key, and proxies the request. The key never reaches the agent.
Install PassControlnpm · BSL-1.1
npm install -g passcontrolIdentity travels · provider secrets do not
01 / Trust boundary
Identity crosses the boundary. Secrets do not.
The passport only signs. A short-lived work-visa carries identity and policy into a gateway that checks every request before resolving a provider credential.
Passport signs
The private Ed25519 key signs a one-time challenge locally. It is never sent on the wire.
signature(challenge)signed proof
Work-visa mintedagent · scope · budget · jti
Gateway governs
- 01Verify visaidentity + expiry
- 02Check kill switchplatform + tenant + agent
- 03Enforce scopeprovider + model + endpoint
- 04Reserve budgettokens + cost before call
Provider vault
key injected only after ✓governed request
Provider receives
PassControl injects the real key in-flight, proxies the call, streams the response, and records the audit.
OpenAIAnthropic
02 / Live keyless demo
Feel the control boundary.
This is a synthesized response, clearly marked [demo]. The surrounding pipeline is real: challenge signing, work-visa, scope, budget, audit, and the demo tenant kill switch.
Demo tenant kill switchDISARMEDDemo tenant accepting requests
Run once, arm the switch, then run the same call again. Disarm to restore it.
Gateway resultstandby
response
Ready. The demo passport is held server-side.
visa ·scope ·budget ·kill switch ·
✓ Real gateway policy checks✓ No provider call✓ No Vault access✓ Demo-only tenant + scope
03 / Control Tower
Control each agent at the gateway.
One inspectable policy boundary for agent identity, credential access, spend, revocation, and the record of every governed call.
Keys stay vaulted
Real OpenAI and Anthropic credentials are resolved inside the gateway only after a request passes policy. They never enter the agent runtime.
Token + cost budgets
Set both limits per agent. PassControl reserves budget atomically before the provider call, when enforcement can still prevent spend.
Instant tenant kill switch
Stop new requests at the gateway without rotating every provider key or reaching into every running agent process.
Control Tower audit
Inspect calls per agent and passport, with provider, model, status, token usage, cost, latency, and request identity in one operator view.
Drop-in gateway
Keep the OpenAI or Anthropic SDK you already use. Re-point its base URL and pass a work-visa instead of a real provider credential.
Native MCP server
Run PassControl as an MCP server for Claude Desktop, Cursor, or Claude Code—the same scope, budgets, audit, and kill switch still apply.
04 / Drop-in adoption
Change the route, not the agent.
Keep the SDK and call shape you already use. Point the base URL at PassControl and supply the short-lived work-visa where the SDK expects an API key.
Inspect the complete core// Same SDK. Governed credential path.
const client = new OpenAI({
baseURL: "https://your-gateway/api/v1/openai",
apiKey: workVisa,
});
const response = await client.chat.completions.create({
model: "your-model",
messages,
});MCP
passcontrol mcpsame policy boundary05 / FAQ
Questions, answered honestly.
The short version of what PassControl is, what it protects, and what it does not — no marketing gloss.
What is PassControl?
PassControl is a source-available identity and credential gateway for AI agents. Instead of putting your OpenAI or Anthropic key inside an agent, each agent gets a cryptographic identity and a short-lived, scoped token — and the gateway injects the real key only after the request passes policy.
Does my agent ever hold my real API key?
No. The agent holds a sign-only Ed25519 passport and mints a short-lived work-visa; the gateway resolves the real provider key from a vault and injects it in-flight, then proxies the call. The key never enters the agent runtime.
Is PassControl open source?
It's source-available under the Business Source License 1.1 — the full working core is free to inspect and self-host, but it is not an OSI open-source license. The plan is open-core: paid hosting and an accountability layer come later.
Is it production-ready and audited?
It's early (v0.4.x), built solo, and not yet independently audited — run it against a non-critical key first. It is built security-first (RLS on every table, a single service-role-only decrypt path, an append-only audit log, tenant-isolation tests), but test-covered and careful is not the same as audited.
Which providers does it support?
OpenAI, Anthropic, Groq, Mistral, Together, and DeepSeek today. Because it is a drop-in gateway, you keep your existing SDK and just point its base URL at PassControl.
How is it different from LiteLLM, Portkey, or an LLM gateway?
Those center on routing, caching, and observability behind a shared key. PassControl centers on per-agent cryptographic identity, capability scoping, per-agent budgets, and instant revocation — and it runs drop-in alongside them.
Won't a 5-minute token break a long-running agent?
No — the agent does not hold the visa. A local sidecar mints and auto-refreshes it (and re-mints instantly on a 401), so a multi-hour session never times out mid-task while revocation stays near-instant. A single long streaming call is verified once at the start and finishes regardless.
Source-available / Self-host
Your agents need identity. Your keys need distance.
Run the complete PassControl core on your own infrastructure and inspect every line in the credential path.
Early (v0.4.x), built in the open, not yet independently audited — run it against a non-critical key first. Security policy