Give your agents real credentials. Keep the receipts.
authtoken is a Credential Broker for AI agents. Store a password, a TOTP seed, an SSH key or an API key once; enroll each Agent as its own revocable Principal; and answer at any time which Agent got what, when, and under whose Grant.
Sign inAsk for accessClosed beta
The terminal is not a vault
Claude Code and Codex are already doing real work, and real work needs a GitHub login, a provider API key, an SSH key, a TOTP code. Today that means pasting a Secret into a terminal an LLM can read. Once it is there, nothing records which Agent used it or when — and taking it back means rotating it everywhere it was ever used.
What makes it different
Every Agent is a Principal, not a shared login
An Agent gets a server-assigned Agent ID, its own rotating Agent Token, and individual revocation. Grants and Audit Events reference that ID, never a shared human account. If a retired Agent Token is presented again, two holders exist — authtoken locks the Agent and tells you.
Deny by default, revoke one thing
An Agent reaches nothing until a Grant says otherwise, scoped to one Target or one Identity. A Secret can require approval, and nothing is dispensed until you decide — on your phone or in the browser. Revoking a Grant costs one Agent its access — not a rotation of every Secret you own.
TOTP seeds do not leave
An Agent asks for a code and receives a code, never the seed. The seed leaves the vault only for you, under Sudo mode, as a deliberate migration.
The trail cannot be edited by what writes it
The database role the application runs as holds no UPDATE and no DELETE on the audit tables. If the audit write fails, the dispense fails. The record of what your agents took is not a debug view that can be quietly tidied.
What is cryptographic, and what is not
Cryptographic
Your Secrets are encrypted under keys we do not have. Only your browser and your own machines hold them, so a stolen database, a stolen backup, an SQL leak — or our own staff with root on the box — reach ciphertext and nothing else. An Agent holds keys for exactly its granted scope. TOTP seeds are never dispensed. The audit trail is append-only by database privilege rather than by convention.
Organizational
What is not cryptographic: TOTP seeds — we compute your codes, so we must be able to read those seeds, and that one Secret type is not end-to-end encrypted. What your Secrets are named and who they are for — Targets, hostnames, Grants and the audit trail are readable to us by design. What Apple, Google, Mozilla and Microsoft see of a notification, if you pair a phone or ask a browser to notify you — a phone's notification crosses in the clear at the detail level you choose; a browser's crosses encrypted, so its push service cannot read the text — and, because we pad every one of those messages out to one of a few fixed sizes, learns from the size only which of those few it fell into; from the urgency and the holding time it can still tell whether the message concerns a Retrieval Approval or a Grant Request. A count only is the floor, and asking neither is the floor below it. And a live compromise of our servers while you are using the web UI — we serve the JavaScript that holds your keys; the CLI is the stronger path. The protections there are organizational: named per-operator SSH keys with no shared accounts, logged access, and production access only for deploys and incidents. The trade you accept in return: lose your password and your Backup Code, and your encrypted Secrets are gone. We can give you your account back; nobody can give you the data.
Closed beta
There is no sign-up yet. A Tenant comes into existence by redeeming an Invite Link, and those are minted by hand. If you would like one, write and say what you would use it for.