Add a custom resource

The Catalog covers common vendors. For anything else, an internal API, an MCP server your team built, a vendor with no catalog entry, register it as a Resource by hand. Once it is a Resource, Keycard treats it like a catalog install: Policies decide who reaches it, a Gateway can serve it, and every credential Keycard issues for it is recorded.

• Manager access to the Zone (see Roles & Permissions)
• The service’s URL, and how it authenticates callers: it verifies Keycard tokens, it has its own OAuth 2.0 authorization server, or it takes a static API key or password

The Credential Provider you pick on the Resource decides what Keycard hands an agent when access is granted. Three kinds appear in the list:

Provider	Pick it when	What the agent receives
Keycard STS, the Zone’s built-in provider	The service accepts tokens from your Zone: a server you built with a Keycard SDK, as in Protect MCP servers and APIs, or a vendor set up to trust your Zone, as in Access Snowflake	A short-lived JWT signed by the Zone
External OAuth	The vendor has its own OAuth 2.0 authorization server	The vendor’s token, brokered by Keycard for the signed-in user
Keycard Vault	The service only takes a static API key or a username and password	The stored secret, brokered and audited on each request

The list also shows the Zone’s sign-in Provider (Keycard ID in an organization Zone), with the same External OAuth badge. It signs people in and isn’t a Resource’s credential provider.

For an External OAuth provider that doesn’t exist in your Zone yet, create it first: open Providers, click Add Provider, and enter the vendor’s Issuer URL, Client ID, and client secret. The advanced options cover vendors that depart from the OAuth defaults: authorization and token URLs, the scope parameter and separator, and where the access token sits in the response.

See Resources › Credentials for the model behind the three kinds.

1. Start the form

   In Keycard Console, open Resources and click Add Resource. Two entries lead to the form:

   • Add Manually opens it empty.
   • Import from URL asks for a Discovery URL, which must be reachable from the public internet: Console fetches it from its own servers, so a localhost or private address fails with Please enter a valid URL. For a local server, use Add Manually or a tunnel. Click Discover: Keycard reads the server’s OAuth protected resource metadata and fills the form in. Check the fields before you continue, including Credential Provider: for a server that verifies Keycard tokens, pick Zone Provider (badge Keycard STS).

   Searching the catalog for a name it doesn’t have shows an Add your own card, which opens the same form with the name filled in.

2. Describe the Resource

   Field	What to enter
   Name	How the Resource appears in Console
   Identifier	A URL for an HTTP service (https://api.example.com); a URN or another opaque string works for anything else. For Keycard-issued tokens it is the aud claim your server checks.
   MCP Server	Turn on when the service speaks MCP. The identifier must then be a URL, because Keycard proxies MCP servers over HTTP(S).
   Use Gateway	Appears when MCP Server is on and the Zone has a gateway. Routes the server through the Zone’s default MCP gateway, or attaches it to a Gateway you created. Choosing the default gateway hands the Resource to that gateway and hides Provided by Application.
   Credential Provider	The provider you chose above. An MCP server needs one before a Gateway can serve it.
   Documentation URL, Description	Optional
   Provided by Application	Marked optional, but required for a server that calls other APIs through Keycard: set it to the Application whose code serves this Resource, or its token exchanges fail with Client is not allowed to exchange token for this resource. Third-party services leave it as None.
   Credential Lifetime	Under Advanced options. How long each issued credential stays valid: 24h by default, from 1m to 24h.

   Click Protect, which carries the name you entered (for example Protect Billing API). Console opens the Resource’s page, with Activity, Actions, Configuration, and Credentials tabs.

3. Add the static credential (Keycard Vault only)

   Open the Resource’s Credentials tab and click Add credential. Choose the Credential Type, API Token or Username & Password, enter the secret, and set the Scopes it carries. Keycard stores it encrypted and returns it only to callers your Policies permit.

4. List its tools (MCP servers you built)

   A catalog install seeds the server’s tool list; a hand-registered server starts with none. To write Policies against individual tools, or to curate them on a Gateway, add them on the Resource’s Actions tab. See Adding new or unlisted MCP tools.

• MCP server: on the Resource’s page, click Add to Coding Agent and pick Cursor, Claude Code, or Install manually, the same as for a catalog install. To serve it beside other servers behind one URL, create a Gateway and add it there as an MCP server.
• API: your code exchanges the caller’s Keycard token for a credential to this Resource. Call External APIs from MCP shows the exchange.

Connect once, then open the Resource’s Activity tab to see the credential Keycard issued and who it was for. See Read an Activity Feed.

• Decide who may reach it with Access Policies.
• For a complete walkthrough that protects a Snowflake MCP server and grants access by Okta group, see Access Snowflake.