Pricing
Start free. Scale when ready.
Every plan includes encryption, scoped tokens, human approvals and the full audit trail. Plans differ only in scale. No credit card required to get started.
Free
No credit card required
For trying it out, and for the agent that just needs its keys out of plaintext.
Get started free →- ✓3 agents
- ✓25 secrets
- ✓10,000 token requests / month
- ✓100,000 gateway requests / month
- ✓7 days audit retention
- ✓Community support
Solo
or $90/year (2 months free)
For the owner running a handful of agents who never wants to see a key in a leak.
Create a free account first, then pay securely with Stripe.
- ✓10 agents
- ✓Unlimited secrets
- ✓100,000 token requests / month
- ✓1,000,000 gateway requests / month
- ✓90 days audit retention
- ✓Human approvals
- ✓Email support
Team
or $990/year (2 months free)
For startups running agents in production with a customer asking about SOC 2.
Create a free account first, then pay securely with Stripe.
- ✓100 agents
- ✓Unlimited secrets
- ✓1,000,000 token requests / month
- ✓10,000,000 gateway requests / month
- ✓1 year audit retention
- ✓Human approvals
- ✓Priority email support
Enterprise
Billed annually
The whole governed stack for a fleet: vault, gateway, Guard and compliance evidence.
Create a free account first, then pay securely with Stripe.
- ✓250 agents included, then $5 per agent / month
- ✓100,000,000 gateway requests / month
- ✓Single sign-on, private hooks, zero-retention mode
- ✓99.9% SLA and dedicated support
Every plan includes scoped tokens, human approvals, the hash-chained audit trail, MCP, CLI and SDKs. Safety is never an upsell.
Entity Gateway
Govern every agent, across three products
Agent Secret Store holds the keys and runs the gateway. Secure My Agent proves the agent is safe. ClawGRC keeps the evidence. One purchase here sets up all three.
Entity Gateway Enterprise
250 agents included, then $5 per agent per month. 100,000,000 gateway requests a month.
Create a free account first, then pay securely with Stripe.
- ✓Agent Secret Store Enterprise: vault, gateway, single sign-on, private hooks, zero-retention mode, 99.9% SLA, dedicated support
- ✓Secure My Agent Guard and checkups for every agent
- ✓A ClawGRC Growth workspace fed by the gateway evidence sink, mapped to OWASP LLM, OWASP Agentic, OWASP MCP, AIUC-1, ISO 42001 and NIST AI RMF
- ✓A monthly signed custom:agentsecretstore:gateway_governed attestation per agent in the Open Entity registry
Included products: Secure My Agent and ClawGRC.
Governed agents bundle
Three products for $399 a month instead of $447 at list price.
Create a free account first, then pay securely with Stripe.
- ✓Agent Secret Store Team
- ✓Secure My Agent Team
- ✓ClawGRC Starter
Each product shows the bundle on its own pricing page: Secure My Agent, ClawGRC. How the gateway works: Entity Gateway guide.
Use Agent Secret Store's models
No provider key needed
Grok and Claude run on our own provider accounts and are paid from prepaid credit at the provider's list price plus 5%. Every verified DID gets a $5 starter credit, once. Credit never expires. Top up $5, $20, $50 by card or with x402; your own provider keys are never marked up.
Balance and ledger: GET https://gateway.agentsecretstore.com/gateway/credits. Card: POST https://gateway.agentsecretstore.com/gateway/credits/checkout. x402: POST https://gateway.agentsecretstore.com/gateway/credits/topup. How it works.
Full feature comparison
Swipe the table sideways to see all plans →
| Feature | Free | Solo | Team | Enterprise |
|---|---|---|---|---|
| Agents | 3 | 10 | 100 | Unlimited |
| Secrets | 25 | Unlimited | Unlimited | Unlimited |
| Token requests / month | 10,000 | 100,000 | 1,000,000 | No cap |
| Audit log retention | 7 days | 90 days | 1 year | 1 year |
| Gateway requests / month | 100,000 | 1,000,000 | 10,000,000 | 100,000,000 |
| Gateway hooks | 1 | 3 | Unlimited | Unlimited |
| Gateway exporters | 0 | 1 | Unlimited | Unlimited |
| Gateway body capture | metadata only, 7 days | full bodies, 30 days | full bodies, 1 year | custom, zero retention available |
| Gateway human approvals | — | ✓ | ✓ | ✓ |
| Gateway budgets | ✓ | ✓ | ✓ | ✓ |
| Scoped, short-lived tokens | ✓ | ✓ | ✓ | ✓ |
| Human approvals (sensitive / critical secrets) | ✓ | ✓ | ✓ | ✓ |
| Envelope encryption (AES-256-GCM + Cloud KMS) | ✓ | ✓ | ✓ | ✓ |
| Hash-chained audit trail + CSV export | ✓ | ✓ | ✓ | ✓ |
| OpenEntity DID on every agent | ✓ | ✓ | ✓ | ✓ |
| MCP server, CLI, Python + JS SDKs | ✓ | ✓ | ✓ | ✓ |
| Support | Community | Priority email | Dedicated |
Frequently asked questions
Is the free tier really free?
Yes. No credit card, no time limit: 3 agents, 25 secrets, 10,000 token requests and 100,000 gateway requests a month, with the same encryption, approvals and audit trail as every paid plan.
Can an agent sign up without me?
Yes, if it has an OpenEntity DID. It proves control of the DID and gets a free unclaimed vault (1 agent, 10 standard secrets, 30 days, 100,000 gateway requests a month), then sends you a claim link. Claiming is free and moves the vault onto your account.
What is the Entity Gateway?
One endpoint for every model call an agent makes. It knows the calling agent by its DID, applies your grants and budgets, runs guard hooks, injects provider keys from the vault so the agent never holds them, and records each call. Your own provider keys are never marked up. It is part of every plan.
What is a gateway request, and what happens at the quota?
One model call through the gateway; the count resets on the 1st of each month (UTC). Past your plan’s quota the gateway answers 429 in your client’s own error format with a link to this page. A hard spend cap is on by default. If you want to keep going, $1 buys 1,000,000 more requests, by card or by an agent paying in USDC with x402.
Can an agent pay without a card?
Yes, in USDC on Base with x402. 1 USDC buys 10,000 extra token requests for the current calendar month (UTC); 1 USDC buys 1,000,000 extra gateway requests for the current calendar month (UTC); 9 USDC buys the Solo plan for 30 days. The agent pays from its own wallet, no human needed. Details in pricing.md.
What is a token request?
One call to POST /v1/tokens that returns a scoped token. A token lives up to 24 hours and covers every read within its scopes, so one request usually serves many secret reads. Requests that only open an approval are not counted.
What happens at a limit?
The API answers HTTP 402 with code PLAN_LIMIT_REACHED, which limit ran out, and the plans that lift it with their prices. An agent can read that and tell its owner exactly what to buy. Nothing is deleted and existing tokens keep working.
Why is Solo so cheap?
Because an agent with plaintext keys is everyone’s problem. We price Solo at what a one-person setup can say yes to without thinking, the same as Secure My Agent Pro, so moving keys out of plaintext is never a budget decision.
Can I switch plans or cancel anytime?
Yes. Upgrades apply immediately through Stripe. Cancel anytime: you keep 30 days of access, then drop to Free limits with your data intact. Enterprise is billed annually.
Is there a self-hosted option?
No. Agent Secret Store is hosted-only by design: managing your own KMS key hierarchy and audit pipeline defeats the purpose of a managed vault.
Custom
Need invoice billing or a security review?
We will set up an Enterprise agreement around your procurement process.
Talk to us →