Run coding agents with Keycard

Agentic coding tools like Claude Code and Cursor need access to production databases, third-party APIs, and internal services to be useful. But broad access creates risk: one misunderstood prompt can lead to a destructive query or a leaked credential.

keycard run narrows that risk by wrapping your coding agent in a secure session with scoped credentials.

1. Install the CLI:

   brew install keycardai/tap/keycard

2. In the root of your project, install the plugin:

   keycard plugin install claude

   Claude Code turns the plugin on for that directory only.

3. Sign in to your Keycard account:

   keycard auth signin --zone <zone-id> --org <org-id>

4. Add a keycard.toml with a Keycard managed resource credential:

   [zone]
   id = "your-zone-id"
   
   [[credentials.default]]
   env_var = "GH_TOKEN"
   resource = "https://api.github.com"

5. Run your agent in a secure session:

   keycard run claude

   The first run opens your browser once more so the Keycard CLI can access https://api.github.com; then the agent starts with GH_TOKEN set.

Keycard handles:

• Just-in-time credentials: Each time the agent runs a command, Keycard exchanges its credentials again and checks policy; MCP servers configured with a header get theirs when the session starts. No secrets stored on disk or in your shell history.
• Centralized visibility: Each session’s prompts and tool calls are recorded under Sessions, and each credential Keycard issues in the Audit Log. Identify rogue agents, review usage patterns, and track credential access across your team.

Inside a keycard run session, Keycard exchanges the credentials in keycard.toml when the session starts, and again before each shell command the agent runs.

This means agents hold only the credentials keycard.toml names, each for as long as its Resource or provider allows. Revoking centrally stops the next credential from being issued, and the one the agent already holds remains valid until it expires, so access ends within the lifetime of the current credential rather than the instant you revoke. Revoke access covers the full behavior.