Documentation

1. Create an account

Sign up at https://app.agentkeys.io and create a workspace. You'll get a workspace API key automatically.

2. Add a credential

Go to Credentials and click Add Credential. Choose the auth type (API Key, Cookie, Basic Auth, etc.) and paste your secret. It's encrypted immediately with AES-256-GCM.

3. Create an agent & assign credential

Go to Agents, create an agent, then click Assign Credential. This generates a proxy token (starts with pxr_). Save it — it's shown only once.

4. Make a proxy call

Send a request through the AgentKeys proxy:

curl -X POST http://localhost:3004/v1/proxy \
  -H "Authorization: Bearer pxr_YOUR_PROXY_TOKEN" \
  -H "X-Target-Url: https://api.openai.com/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello!"}]}'

AgentKeys decrypts the real credential, injects it into the request headers, forwards to the target API, and returns the response. Your agent never touches the real secret.

Workspace

A workspace is your organization. It contains credentials, agents, and audit logs. Each workspace has its own encryption master key and API key.

Credential

A secret stored in AgentKeys — API key, OAuth token, password, cookies, or headers. Encrypted with AES-256-GCM at rest. The plaintext is never stored.

Agent

Represents your AI tool, bot, or script. Each agent can be assigned specific credentials and receives a unique proxy token for each one.

Proxy Token

A unique token (prefixed pxr_) that maps to one credential + one agent. The agent uses this token to make API calls through the proxy. The real credential is resolved and injected at request time.

Headers

All other headers (except Host) are passed through to the target.

How it works

1. Agent sends request with pxr_ proxy token
2. AgentKeys validates the token and resolves the credential
3. Real credential is decrypted (AES-256-GCM)
4. Credential is injected into the request headers
5. Request is forwarded to the target API
6. Response is returned to the agent
7. Request is logged in the audit trail

Examples

OpenAI:

curl -X POST http://localhost:3004/v1/proxy \
  -H "Authorization: Bearer pxr_openai_abc123" \
  -H "X-Target-Url: https://api.openai.com/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello!"}]}'

Resend (email):

curl -X POST http://localhost:3004/v1/proxy \
  -H "Authorization: Bearer pxr_resend_def456" \
  -H "X-Target-Url: https://api.resend.com/emails" \
  -H "Content-Type: application/json" \
  -d '{"from": "hi@yourdomain.com", "to": "user@example.com", "subject": "Hello", "text": "Hello!"}'

GitHub (GET request):

curl http://localhost:3004/v1/proxy \
  -H "Authorization: Bearer pxr_github_ghi789" \
  -H "X-Target-Url: https://api.github.com/user/repos" \
  -H "X-Target-Method: GET"

TypeScript

npm install @agentkeys/sdk

import { AgentKeys } from "@agentkeys/sdk";

const ak = new AgentKeys({ proxyUrl: "http://localhost:3004" });

const res = await ak.proxy("pxr_YOUR_TOKEN", {
  url: "https://api.openai.com/v1/chat/completions",
  method: "POST",
  body: { model: "gpt-4o", messages: [{ role: "user", content: "Hello!" }] },
});

console.log(res.data);

Python

pip install agentkeys

from agentkeys import AgentKeys

ak = AgentKeys(proxy_url="http://localhost:3004")

res = ak.proxy(
    token="pxr_YOUR_TOKEN",
    url="https://api.openai.com/v1/chat/completions",
    method="POST",
    body={"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello!"}]},
)

print(res.json())

Install the skill

clawhub install agentkeys

Or manually: download the skill folder into your OpenClaw workspace at skills/agentkeys/.

Configure

Add the following to your OpenClaw workspace .env or TOOLS.md:

AGENTKEYS_PROXY_URL=http://localhost:3004
AGENTKEYS_TOKEN=pxr_YOUR_PROXY_TOKEN

The skill reads these values automatically and uses them when making proxied requests.

Usage

Once installed, just ask your agent to make API calls. The AgentKeys skill intercepts outgoing requests and routes them through the proxy:

You: Send an email via Resend to user@example.com
Agent: (uses AgentKeys proxy → Resend API) ✅ Email sent!

You: Get my GitHub repos
Agent: (uses AgentKeys proxy → GitHub API) Here are your repos...

Your agent never sees the real API keys. Everything is proxied through AgentKeys, encrypted, and logged in the audit trail.

Skill Marketplace

The AgentKeys skill is available on ClawHub — the OpenClaw skill marketplace. Install it with one command and start proxying credentials securely in minutes.