Let your AI agents act on your cloud — without ever holding a secret.
PastKeys is a credential broker for AI agents and automated workloads. You store your provider tokens (Cloudflare, GitHub, AWS, Postgres, any HTTP API) sealed to your own broker — we can't read them. Your agent asks the broker to perform an operation; the broker checks a default-deny policy, uses a short-lived scoped credential, runs it, and returns only the result. Every request is written to a tamper-evident audit log.
ZERO-ACCESS CUSTODY · DEFAULT-DENY POLICY · SHORT-LIVED CREDENTIALS · COMPLETE AUDIT
The broker authenticates the workload, evaluates a default-deny policy, uses a credential that never leaves the enclosure, and logs the result.
┌─────────┐
│ AGENT │ intent: "create A record api.example.com"
└────┬────┘
│ request (operation, never a secret)
▼
╔═════════════════════════════════════════════╗ ◄── trust boundary
║ CREDENTIAL BROKER ║
║ ┌──────┐ ┌────────┐ ┌────────────┐ ║
║ │ AUTH │──►│ POLICY │──►│ CREDENTIAL │ ║
║ └──────┘ └────────┘ └─────┬──────┘ ║
║ who? may it? sealed │ scoped ║
║ ┌────────┐ ▼ ║
║ │ AUDIT │◄────────────── executes ║
║ └────────┘ one event / request ║
╚════════════════════┬════════════════════════╝
│ short-lived · least-privilege
▼
┌───────────┐
│ PROVIDER │ cloudflare · github · aws · db · ssh
└───────────┘
agent ◄── RESULT only, never the key
Privilege reachable by a compromised agent, measured as a share of the underlying credential's power. To scale, 0–100%.
CREDENTIAL LIFETIME — dimensioned, provider permitting:
├──────── 60 s TTL ────────┤ scoped to: 1 zone · 1 action · 1 request-id
Assume the agent's runtime, context, or logs are fully exposed. What can the attacker actually reach?
CASE: agent runtime / context leaked TRADITIONAL PASTKEYS ─────────── ──────── attacker ─▶ CLOUDFLARE_API_TOKEN attacker ─▶ short-lived session │ │ ┌───────────┼───────────┐ already spent · bound to ▼ ▼ ▼ 1 request-id all zones all records acct policy re-denies everything else audit already recorded the attempt reachable: EVERYTHING reachable: ~NOTHING
Pick a request. The bench evaluates it exactly like pastkeys policy test: allow only on an explicit rule match, everything else denied, errors fail closed.
Adapters implement a common contract. Where the provider supports it, the broker mints a short-lived, scoped credential per operation; where it can’t, a protected long-lived token stays broker-side and is never exposed to the agent.
| Item | Adapter | Operations | Credential | Status |
|---|---|---|---|---|
| 01 | aws (sts) | assume-role session · s3 list · caller identity | short-lived | built |
| 02 | github | repo read · issue read/create · pr read | scoped ~1h token | built |
| 03 | postgres | dynamic role · read-only query | short-lived role | built |
| 04 | cloudflare | DNS read / create / update / delete | pass-through | built |
| 05 | http (generic) | any REST endpoint | pass-through | built |
| 06 | ssh (ca) | certificate issuance | short-lived cert | research |
Verify the agent's workload identity.
Default-deny policy over agent, provider, resource, action.
Fetch a sealed credential; scope + time-limit where the provider allows.
Perform the operation; return only the result.
Write one secret-free event. Any error resolves to DENY.
Free and open source, self-hosted. Managed control plane, SSO, approvals, SIEM export and customer-managed keys (BYOK) come with the team tier.