Guides

Step-by-step guides for building with Keycard, using the CLI with your coding agent, or directly with the SDK.

Step-by-step guides for building with Keycard. New to Keycard? Start with the Quickstart, or read What is Keycard to see where it fits. How Keycard works explains the model underneath.

Build tools

BUILD TOOLS

Put Keycard in front of the MCP servers and APIs you build, and let them call other services as the signed-in user or as themselves, with the Keycard SDKs.

Protect MCP servers and APIsPut Keycard in front of an MCP server or an API so every request carries a verified user, explicit scopes, and an audit record.

Call other servicesPick how your tool or agent calls another service: as the signed-in user, or as your Application.

Act on behalf of usersLet a tool or agent call an API as a specific person, whether they are in the loop or away, with a short-lived credential per request and the user named in the audit log.

Act on Behalf of Absent UsersBuild a background agent that impersonates a user who isn’t present, after a one-time consent, with short-lived per-request tokens and full audit attribution.

Access APIs on Behalf of UsersBuild agents that act on behalf of signed-in users, with each API call scoped to that user’s identity, permissions, and audit attribution.

Call External APIs from MCPGive your MCP tools access to GitHub, Google, and other APIs on behalf of users. Keycard handles OAuth token exchange, per-user scoping, and audit, with no stored secrets.

Connect agents

CONNECT AGENTS

Put Keycard between Claude Code, Cursor, or a Slack bot and the tools it uses, through a Gateway or the Keycard CLI.

Connect coding agentsPut Keycard between Claude Code or Cursor and the tools it uses: through a Gateway with no code, or by starting the agent with the Keycard CLI.

Build a Slack agentBuild a Slack bot that answers questions from each user’s Google Calendar through a Keycard-protected MCP server, with per-user authorization instead of a shared service-account token.

Run Claude Code with the Keycard CLIRun Claude Code in an audited Keycard session in minutes.

Connect Claude to ResourcesHydrate static and OIDC credentials from Keycard-managed Resources into your coding agent’s session with one uniform mechanism and no secrets on disk.

Add tools and services

ADD TOOLS AND SERVICES

Bring the APIs and MCP servers your agents call under Keycard. Start with the catalog; register anything else as a custom Resource.

Add a custom resourceRegister an API or MCP server the catalog doesn’t cover, so Keycard issues its credentials, applies your Policies, and records every call.

Application identity

APPLICATION IDENTITY

Give a deployed service or an autonomous agent an identity of its own, so it authenticates with the platform’s OIDC token instead of a stored secret.

Authenticate deployed workloadsLet a deployed service prove who it is to Keycard with the OIDC token its platform already issues. No client secret to store or rotate.

Grant an agent access to SnowflakeBuild an autonomous agent that authenticates to Snowflake as itself with Workload Identity Federation. No human approvals, no stored secrets.

Run on Fly.io without secretsRun services without long-lived API keys. The workload’s own identity authorizes every call, with short-lived scoped credentials per request.

Run on Render without secretsDeploy your MCP server to Render with no client secret. Render’s managed OIDC token proves the service’s identity to Keycard, rotated automatically with nothing to leak.

Control access

CONTROL ACCESS

Decide who and what can reach each Resource with Access Policies, and grant access by directory group.

Access SnowflakeControl Snowflake access through Keycard using Okta groups, JWT authentication, and policy-based authorization for AI agents.