Add tools and services
Add provider APIs without keys
Get short-lived credentials for external provider APIs such as Anthropic's and OpenAI's, with no static keys to store or rotate.
Keycard issues short-lived, scoped credentials that external providers accept via Workload Identity Federation (WIF). Your application authenticates to Keycard, requests a token for a specific provider, and uses that token directly with the provider’s API. No API keys stored anywhere.
Your AppUses credential with provider
Keycard-minted access token
Provider APIShort-lived token, no secrets stored
Keycard ZoneIssues scoped credential
Provider WIFValidates JWT, returns access token
How it works
Section titled “How it works”- Register the external API as a resource and select your zone provider as the credentials issuer
- Configure the external provider to trust your zone’s OIDC issuer — each provider guide walks through this
- Your application authenticates to Keycard and requests a token scoped to the external resource
- Keycard issues a short-lived OIDC JWT signed by your zone, which the provider validates and exchanges for an access token
For the conceptual model behind access federation and brokered credentials, see Providers.