Skip to content
Agent Secret Store

Guide · 6 min read

Your agents never see a provider key: the Entity Gateway

Most agents call a model with a provider key they can read. Anyone who can read the agent's environment, its logs or its prompt can read the key too. The Entity Gateway moves that key out of the agent and into the vault, and puts one checkpoint on every model call.

What it does

You point your client at https://gateway.agentsecretstore.com instead of the provider. It speaks the OpenAI (chat completions and responses), Anthropic, Gemini and Bedrock wire formats, so Claude Code, Codex and the official SDKs work without changes. For each request the gateway works out which agent is calling, checks that agent is allowed to use that model, checks its budget, runs your guard hooks, adds the provider key from your vault, streams the answer back unchanged, and records what happened.

Why

  • Keys never sit in the agent. The agent holds a short-lived gateway token, or nothing but its own signing key. The provider key is read from the vault inside the gateway for the length of one call. A leaked agent environment leaks a token that expires, not your provider account.
  • Every call is tied to a DID. The caller is the agent's Open Entity identity, not a shared key that a dozen agents use. Grants say which DIDs, tags, roles or registry trust tiers may use which models, and everything is denied until a grant allows it.
  • Budgets stop the runaway loop. Dollar buckets per agent or per team refill daily. When one is empty the call is refused, or it asks a human to approve.
  • Guard hooks see the call first. A hook is any HTTPS endpoint. It can allow, block, rewrite or escalate a request before the provider sees it. Secure My Agent Guard is built to be one: see Guard every model call.
  • You get evidence. Each call is logged with its DID, model, tokens, cost and tool names. Export it to ClawGRC, which keeps it as hash-chained evidence mapped to compliance controls (gateway evidence docs), or to your own OTLP, Splunk, S3 or GCS sink.

Start in three steps

1. Put your provider key in the vault.

ass secrets set gateway/ANTHROPIC_API_KEY     # value on stdin

2. Write a config and publish it. A provider, one grant, one budget. The config is HuJSON, and it holds vault references, never keys.

{
  "providers": [
    { "id": "anthropic", "type": "anthropic", "secret": "gateway/ANTHROPIC_API_KEY", "models": ["claude-*"] },
  ],
  "grants": [ { "id": "my-agent", "src": ["did:key:z6Mk..."], "models": ["claude-*"] } ],
  "budgets": [ { "id": "daily", "key": "<did>", "capacity_usd": 5, "refill_usd_per_day": 5 } ],
}
curl -X PUT https://gateway.agentsecretstore.com/gateway/config \
  -H "Authorization: Bearer $ADMIN_TOKEN" --data-binary @gateway.hujson

3. Give the agent a token and a base URL.

export ANTHROPIC_BASE_URL=https://gateway.agentsecretstore.com
export ANTHROPIC_API_KEY="$GATEWAY_TOKEN"   # from POST /v1/tokens, scope gateway:invoke:*
claude

Codex and the OpenAI SDKs use OPENAI_BASE_URL=https://gateway.agentsecretstore.com/v1. Gemini uses the /v1beta path. Bedrock has its own path. An agent that would rather carry no token can sign each request with its DID key (RFC 9421; see the Open Entity signed requests guide). The full walkthrough, with the config schema, the hook protocol and every error shape, is in the Entity Gateway docs guide.

Pricing

The gateway is part of every Agent Secret Store plan, the free one included, with 100,000 requests free. Your own provider keys are never marked up: you pay the provider directly at the provider's price. Plan limits, overage and the Enterprise offer are on the pricing page.

Read next

Read the guideSee pricing