Guides
Step-by-step guides for building with Keycard, using the CLI with your coding agent, or directly with the SDK.
Step-by-step guides for building with Keycard. New to Keycard? Start with the Quickstart to get up and running, or read about How Keycard Works to understand the Keycard domain model.
Use Coding Agents
Section titled “Use Coding Agents”USE CODING AGENTS
Secure an agentic coding tool like Claude Code or Cursor with the Keycard CLI.
Connect Claude to ResourcesHydrate static and OIDC credentials from Keycard-managed Resources into your coding agent’s session with one uniform mechanism and no secrets on disk.Control Tool CallsEnforce a default-deny Cedar policy on every tool call your agent makes, with in-the-loop approvals for sensitive actions and a full session audit trail.
Build with Coding Agent
Section titled “Build with Coding Agent”BUILD WITH CODING AGENT
Ask your coding agent to build agents and services with their own Keycard identity, scoped permissions, and audit trail.
Access APIs on Behalf of UsersBuild agents that act on behalf of signed-in users, with each API call scoped to that user’s identity, permissions, and audit attribution.Run Apps Without Static SecretsRun services without long-lived API keys. The workload’s own identity authorizes every call, with short-lived scoped credentials per request.Grant Agent Access to APIsBuild autonomous agents and multi-agent systems where each agent has its own identity, scoped permissions, and audit trail, independent of any human.
Use the SDK
Section titled “Use the SDK”USE KEYCARD SDKS
Integrate Keycard directly into your code with the Keycard SDKs. No CLI required.
Add Auth to Custom MCPAdd OAuth-based authentication to a custom MCP server so every tool call is tied to a verified user, scoped to explicit permissions, and logged for audit.Call External APIs from MCPGive your MCP tools access to GitHub, Google, and other APIs on behalf of users. Keycard handles OAuth token exchange, per-user scoping, and audit, with no stored secrets.Protect an APIBuild an API that knows which agent is calling and why, with per-request credentials scoped to one user, one agent, and one action.Act on Behalf of Absent UsersBuild a background agent that impersonates a user who isn’t present, after a one-time consent, with short-lived per-request tokens and full audit attribution.
Build Agents
Section titled “Build Agents”BUILD AGENTS
Build agents and services with their own identity, scoped permissions, and audit trail.