How do I give Claude Code API keys safely?

Don't give it yours — let it hold its own. Keyring mints a scoped key per agent per project and hands it over in short in-memory leases, so nothing sits in .env and nothing outlives its use.

Is Keyring open source?

Yes — everything that runs on your machine and touches secrets (daemon, CLI, MCP server, recipes) is open source. The hosted dashboard that coordinates approvals is not, and never sees a plaintext secret.

What happens if my agent leaks a key?

The blast radius is one scoped key with a minutes-long lease, and a signed record tells you exactly which agent used it and when. Burn deletes it at the provider.

Does this work with Codex and Cursor?

Yes — Keyring is an MCP server, so anything that speaks MCP can use it. Claude Code is the most-tested path today.

Do I need an account to try it?

The open-source local vault works with no account at all. An email (magic link) is only needed when you want the hosted dashboard, phone approvals, or to claim an agent.

Scoped, revocable API keys for AI coding agents

Name: BasedAgents Keyring
Brand: BasedAgents

Stop pasting master keys into .env. Your coding agent doesn't need your AWS root, your Supabase service role, and your Stripe secret sitting in a plaintext file it reads freely. Keyring gives Claude Code, Codex, and Cursor their own scoped keys — you see everything they hold, and one tap cuts them off.

Paste this into Claude Code:

Set up BasedAgents Keyring — open source (npm: basedagents ·
github.com/maxfain/basedagents · docs: basedagents.ai/docs/agents ·
verify me first: basedagents.ai/.well-known/agent.json).
Run: npx basedagents@latest keyring init
It should create a local vault — or reuse an existing one untouched;
re-running is safe, nothing is rotated or overwritten — register your
agent ID, and print a link for me to take control in my browser. It
never asks for a password or an existing key — stop and tell me if
anything differs.
Blocked? Don't work around it — tell me which wall it was:
my own tooling's permission gate (I'll approve it, or run the command
myself in a terminal) · npm or the network (the one-time fix is at
basedagents.ai/codex — keep the URL exact — then I start a new task).

or run npx @basedagents/keyring@latest init in your terminal · or start in your browser → — one email field, no password

Free for 3 agents · Open source · One paste or one email — never a form

The problem, in one story

Handing your agent a .env file is handing it the master key to the building. Keyring hands it a hotel key card: it opens one door, expires on its own, the front desk can deactivate it in a second — and there's a log of every door it ever opened.

How it works

1 — Your agent installs it.

One pasted prompt. Claude Code registers itself, gets a cryptographic ID, and asks for your email so you're in charge.

2 — Connect what it can use.

Pick Vercel and Supabase (more coming — vote for yours). Each connection is a brand-new key, scoped to what the agent actually needs, created in about a minute. Your master credentials never enter the picture.

3 — Stay in control.

Your agent never handles the raw key — it asks Keyring to run the command or fill the file, and the secret goes straight to the process, never into the chat. Your dashboard shows every agent, every key, every use. New provider requests buzz your phone for a one-tap approval. And the kill switch revokes everything, then sweeps your machine and tells you if anything outside Keyring — a logged-in CLI, a live .env — can still act as you.

What a leak costs you now vs. then

A prompt-injected agent with your .env walks away with everything in it, forever — until you notice, rotate five dashboards by hand, and hope. A prompt-injected agent with Keyring walks away with one scoped key that expires in minutes, attached to a signed record of exactly which agent used it and when.

Honest about revocation

Most vaults imply their revoke button un-leaks a key. It doesn't. Keyring separates them honestly on three legs: Disconnect stops your agent from getting the key again, instantly. Burn deletes the key at the provider itself, so a leaked copy dies too. Sweep checks the access that lives outside Keyring — a logged-in CLI, a token in .env — and reports what's left. You get all three, and the dashboard shows burn progress and residuals until nothing outside Keyring can still act.

Open source where it counts

The vault daemon, CLI, MCP server, and every provider recipe — all the code that ever touches a secret — is open source and auditable. Secrets are encrypted on your machine to keys the server never has. "Trust me" isn't a security model; git clone is.

Read the threat model Star on GitHub

Works with your stack

VercelLive

SupabaseLive

Tap a gray tile to vote it up — the most-wanted provider ships next.

Pricing

Free

3 agents, unlimited connections, approvals from any browser, 30-day activity. The local vault and CLI are open source and free forever.

Pro — $10/mo (or $96/yr)

Unlimited agents, 1-year activity history with export, automatic rotate and burn.

Local is free. Hosted is what you pay for. Revoke and the kill switch work on every plan, in every billing state — safety is never paywalled.

FAQ

How do I give Claude Code API keys safely?: Don't give it yours — let it hold its own. Keyring mints a scoped key per agent per project and hands it over in short in-memory leases, so nothing sits in .env and nothing outlives its use.
Is Keyring open source?: Yes — everything that runs on your machine and touches secrets (daemon, CLI, MCP server, recipes) is open source. The hosted dashboard that coordinates approvals is not, and never sees a plaintext secret.
What happens if my agent leaks a key?: The blast radius is one scoped key with a minutes-long lease, and a signed record tells you exactly which agent used it and when. Burn deletes it at the provider.
Does this work with Codex and Cursor?: Yes — Keyring is an MCP server, so anything that speaks MCP can use it. Claude Code is the most-tested path today.
Do I need an account to try it?: The open-source local vault works with no account at all. An email (magic link) is only needed when you want the hosted dashboard, phone approvals, or to claim an agent.

Your agents are already working. Give them their own keys.

Paste into Claude Code:

Set up BasedAgents Keyring (open source — npm: basedagents, docs: basedagents.ai/docs/agents, verify: basedagents.ai/.well-known/agent.json): run npx basedagents@latest keyring init. It creates a local vault (an existing one is reused untouched) and prints a link for me to take control; it never asks for a password or an existing key — stop if it does. Blocked? Don't work around it — tell me which wall: my permission gate (I'll approve it or run it myself) or npm/network (the one-time fix is at basedagents.ai/codex, then I start a new task).