# Keycard Documentation

Keycard is the identity and access management platform for AI agents. It adds
OAuth-based authentication and authorization to MCP servers and agent workflows
so every tool call is tied to a verified user, scoped to explicit permissions,
and logged for audit.

> Full concatenated corpus: https://docs.keycard.ai/llms-full.txt
> API reference (server-rendered from OpenAPI, not in this index): https://docs.keycard.ai/api

When installing Keycard SDKs, always check the package registry for the latest
version rather than relying on memorized version numbers. For Python, check
https://pypi.org/project/keycardai/. For TypeScript (npm), check
https://www.npmjs.com/package/@keycardai/mcp. For Go, check
https://pkg.go.dev/github.com/keycardai/credentials-go. Never hardcode old
version numbers. Always install with the latest version or verify first.

## Get Started
- [Quickstart](https://docs.keycard.ai/guides/quickstart.md): Set up policy-enforced, audited agentic coding in minutes
- [How Keycard works](https://docs.keycard.ai/guides/how-keycard-works.md): Understand how Keycard governs access in agentic, federated systems.

## Guides
- [Access APIs on Behalf of Users](https://docs.keycard.ai/guides/access-apis-on-behalf-of-users.md): Build an app or custom MCP server that accesses APIs on behalf of your users without storing tokens.
- [Run Apps Without Static Secrets](https://docs.keycard.ai/guides/run-apps-without-static-secrets.md): Deploy services that authenticate themselves without API keys or secrets in environment variables.
- [Grant Agent Access to APIs](https://docs.keycard.ai/guides/grant-agent-access-to-apis.md): Build an autonomous agent that authenticates to Snowflake using Workload Identity Federation. No human approvals, no stored secrets.
- [Why Keycard](https://docs.keycard.ai/guides/why-keycard.md): Why AI agents need a new approach to identity, access, and trust
- [Build a Slack agent](https://docs.keycard.ai/guides/slack-agent.md): Build a Slack bot that answers questions from each user's Google Calendar through a Keycard-protected MCP server, with per-user authorization instead of a shared service-account token.
- [Run coding agents with Keycard](https://docs.keycard.ai/guides/secure-agentic-coding.md): Wrap Claude Code, Cursor, and other coding agents in a secure Keycard session with scoped credentials, policy enforcement, and audit logs.
- [Deploy an MCP server on Cloudflare Workers](https://docs.keycard.ai/guides/cloudflare-worker.md): Deploy a Keycard-protected MCP server on Cloudflare Workers with JWT verification, token exchange, and isolate-safe caching
- [Migrate to FastMCP 3.0](https://docs.keycard.ai/guides/fastmcp-3-migration.md): Upgrade your Keycard-protected MCP server from FastMCP 2.x to 3.0
- [Anthropic](https://docs.keycard.ai/guides/access-provider-apis/anthropic.md): Set up credential brokering for Anthropic APIs so your workloads authenticate with Keycard-issued OIDC tokens instead of static API keys
- [Access Provider APIs](https://docs.keycard.ai/guides/access-provider-apis/overview.md): Use Keycard SDKs to get scoped credentials for external APIs. No static secrets, no manual rotation.
- [Access Snowflake](https://docs.keycard.ai/guides/access-snowflake.md): Control Snowflake access through Keycard using Okta groups, JWT authentication, and policy-based authorization for AI agents.
- [Act on Behalf of Absent Users](https://docs.keycard.ai/guides/act-on-behalf-of-absent-users.md): Build a background agent that calls APIs as a specific user who isn't present, using short-lived per-request tokens and the Keycard SDK.
- [Connect Claude to Resources](https://docs.keycard.ai/guides/connect-claude-to-resources.md): Hydrate credentials from Keycard into Claude Code session.
- [Control Tool Calls](https://docs.keycard.ai/guides/control-tool-calls.md): Enforce a default-deny Cedar policy on every Claude Code tool call, CLI and MCP alike, with in-the-loop approvals and a full audit trail.
- [Call External APIs from MCP](https://docs.keycard.ai/guides/delegated-access.md): Connect MCP tools to third-party APIs via OAuth
- [GitHub](https://docs.keycard.ai/guides/delegated-access/github.md): Build an MCP server with GitHub API tools using Keycard delegated access
- [Google Workspace](https://docs.keycard.ai/guides/delegated-access/google.md): Build an MCP server with Google Calendar and Drive tools using Keycard delegated access
- [Add Auth to Custom MCP](https://docs.keycard.ai/guides/mcp-server.md): Add OAuth-based authentication to an MCP server with Keycard
- [Protect an API](https://docs.keycard.ai/guides/protect-any-api.md): Build an API that knows which agent is calling and why, then give agents scoped credentials without touching their code.

## Admin
- [Operate](https://docs.keycard.ai/platform/operate.md): Admin, security, and operational controls for running Keycard in production.
- [Single Sign-On](https://docs.keycard.ai/admin/single-sign-on.md): Configure SSO for your Keycard organization
- [Roles & Permissions](https://docs.keycard.ai/admin/roles-and-permissions.md): Manage who can administer your Keycard organization and zones
- [Audit Log Export](https://docs.keycard.ai/admin/audit-log-export.md): Export Keycard audit logs to your S3 bucket in OCSF format
- [Catalog](https://docs.keycard.ai/admin/catalog.md): Pre-configured MCP servers and OAuth-protected APIs, all governed by Keycard identity, policy, and audit.
- [Access Policies](https://docs.keycard.ai/admin/access-policies.md): Configure fine grained access control policies
- [Reading the Audit Log & Sessions](https://docs.keycard.ai/admin/audit-log-and-sessions.md): Read Keycard's Console Audit Log and Sessions views to trace an agent's identity, follow one action end to end, and verify that access changes took effect.
- [Configure Anthropic](https://docs.keycard.ai/admin/configure-provider-apis/anthropic.md): Set up credential brokering so workloads authenticate to Claude API with Keycard-issued tokens instead of static API keys
- [Provider APIs Overview](https://docs.keycard.ai/admin/configure-provider-apis/overview.md): Use Keycard to get scoped credentials for external APIs. No static secrets, no manual rotation.
- [Deployment](https://docs.keycard.ai/admin/deployment.md): Understanding Keycard's deployment options for different security and compliance needs
- [Identity Providers](https://docs.keycard.ai/admin/identity-providers.md): Connect your own OAuth 2.0 identity provider to a Keycard zone
- [Revoke a Grant](https://docs.keycard.ai/admin/revoke-a-grant.md): Cut off an Application's access on behalf of a User by revoking a grant, from the Console or the management API.
- [Connect Auth0](https://docs.keycard.ai/admin/tutorials/auth0-sign-in.md): Connect Auth0 as an identity provider for zone-level user authentication.
- [Connect Okta](https://docs.keycard.ai/admin/tutorials/okta-sign-in.md): Connect Okta as an identity provider for zone-level user authentication.
- [Fine-Grain Authorization](https://docs.keycard.ai/admin/unified-access-gateway/fine-grain-authorization.md): Write Policies that permit or deny individual MCP tool calls through a Unified Access Gateway
- [Usage & Billing](https://docs.keycard.ai/admin/usage.md): Understanding Keycard's billing model
- [Zone Authentication](https://docs.keycard.ai/admin/zone-authentication.md): Configuring and using Zone Authentication
- [Custom Zones](https://docs.keycard.ai/admin/zones.md): Create a custom Zone and configure admin access and user authentication

## Concepts
- [Zones](https://docs.keycard.ai/concepts/zones.md): Overview of zones within the Keycard platform.
- [Users](https://docs.keycard.ai/concepts/users.md): Overview of users within the Keycard platform.
- [Applications](https://docs.keycard.ai/concepts/applications.md): Overview of applications within the Keycard platform.
- [Resources](https://docs.keycard.ai/concepts/resources.md): Overview of resources within the Keycard platform.
- [Providers](https://docs.keycard.ai/concepts/providers.md): Overview of providers within the Keycard platform.
- [Policies](https://docs.keycard.ai/concepts/policies.md): How Keycard decides whether users and applications can access resources.
- [Credential Issuance](https://docs.keycard.ai/concepts/credentials.md): Overview of the different methods Keycard offers to issue credentials.

## Reference
- [CLI](https://docs.keycard.ai/cli.md): Install, authenticate, manage credentials, authorize resources, and run commands in secure sessions with Keycard.
- [keycard-credentials](https://docs.keycard.ai/skills/keycard-credentials.md): Shows what credentials are configured in this Keycard session — which services are available and what they provide access to.
- [keycard-discover-entities](https://docs.keycard.ai/skills/keycard-discover-entities.md): Discover and wire credential entities or MCP servers via the Keycard Management API — find available entity URIs and register them in keycard.toml, or find MCP-provider applications and add them to .mcp.json.
- [keycard-query-policy](https://docs.keycard.ai/skills/keycard-query-policy.md): Answer questions about the active Cedar policy and diagnose tool blocks — read-only; does not modify the policy.
- [keycard-upsert-config](https://docs.keycard.ai/skills/keycard-upsert-config.md): Set or change a field in keycard.toml — reads the current value and writes a targeted update.
- [keycard-upsert-mcp-config](https://docs.keycard.ai/skills/keycard-upsert-mcp-config.md): Add or update an MCP server entry in .mcp.json.
- [keycard-upsert-policy](https://docs.keycard.ai/skills/keycard-upsert-policy.md): Propose, confirm, and apply a Cedar policy change — propose → confirm → write → verify.
- [Agent-to-Agent](https://docs.keycard.ai/sdk/agent-to-agent.md): Agent-to-agent delegation using the A2A protocol.
- [Cloudflare Workers](https://docs.keycard.ai/sdk/cloudflare.md): Keycard auth for Cloudflare Workers. JWT verification, token exchange, and isolate-safe caching.
- [MCP](https://docs.keycard.ai/sdk/mcp.md): OAuth authentication for MCP servers. Bearer middleware, metadata endpoints, and grant decorators.
- [OAuth Primitives](https://docs.keycard.ai/sdk/oauth.md): Low-level OAuth 2.0 primitives for discovery, token exchange, and JWT operations.
- [Security Architecture](https://docs.keycard.ai/reference/security-architecture.md): Keycard's security model, encryption, and data protection
- [Supported Standards & Protocols](https://docs.keycard.ai/reference/standards.md): Every protocol, standard, and interface supported by Keycard - available on all plans