Keycard

Keycard is a cloud-native identity and access management platform built for AI agents rather than human users. It positions itself as a control plane governing agent access to tools, APIs and data: each agent receives an identity, each tool call is authorized with a credential, and each action is written to an audit log. The platform resolves a composite identity from the user, device, agent workload and task, evaluates policy at the moment a credential is requested, issues short-lived and resource-scoped tokens, and streams structured telemetry of every tool call and policy decision to SIEM systems such as Splunk and Datadog.

The company frames the problem as the failure of traditional IAM, which assumes long-lived and stable identities, to handle agents that spin up by the thousands, terminate quickly and act on behalf of different users and systems. Rather than storing static API keys and secrets, Keycard replaces them with dynamic, identity-bound, task-scoped tokens that are revocable in-band and that never enter the agent's context window. It operates as a federated identity broker, converting credentials from existing identity providers (Okta, Auth0, Google or any OIDC provider) into agent-aware tokens instead of replacing those providers.

Product surfaces include a CLI (a `keycard run` command that governs coding agents running shell commands, scripts and API calls), SDKs for adding OAuth-based authentication to MCP servers in Python, TypeScript, Go and Ruby, low-level OAuth 2.0 primitives, agent-to-agent (A2A) authentication, and a gateway that proxies requests and injects tokens for systems that cannot run an SDK. Administrative features cover SSO, roles and permissions scoped to organization or zone, audit log export, and a catalog of one-click integrations with APIs including Gmail, Slack, GitHub and Linear.

Founding story

The idea originated in early 2023 after CircleCI disclosed that hackers had stolen encryption keys, invalidating customer API tokens. Snyk was a CircleCI customer, and Livingstone and Creager — then at Snyk following its acquisition of their prior startup Manifold, where Livingstone was CTO and Creager led developer relations — had to manually map and rotate credentials across the organization, producing a spreadsheet of more than 10,000 credentials. Livingstone concluded that the answer was eliminating secrets rather than storing them better, and recruited Jared Hanson, previously chief architect at Auth0 through its acquisition by Okta, as a third co-founder for identity security expertise.

Business model

B2B SaaS infrastructure sold to developers and security teams building AI agent systems, sitting between agents and the APIs and systems they access and providing dynamic access control as a service in place of static API keys and role-based tokens.

Pricing and the revenue model had not been disclosed as of the early access period; Keycard documentation references organization-level billing configuration.

Traction

The company launched publicly in October 2025 and had not disclosed pricing or customer metrics as of the early access period.

Latest developments

Following the October 2025 stealth exit, Keycard said proceeds would fund development of its IAM platform, expansion of its research and development team, and standards work on Model Context Protocol and OAuth extensions for AI agents. The company has also announced Keycard for Multi-Agent Apps.