Show HN: Scoped, expiring API keys for AI agents
So I hacked together a tiny package called Kage Keys - https://github.com/kagehq/keys
It lets you wrap agent actions with scoped, short-lived tokens instead of handing over your real API keys.
Example:
```js import { withAgentKey, getLogs } from "@kagehq/keys";
async function main() { await withAgentKey("github:repos.read", async () => { console.log("Agent is calling GitHub API..."); });
console.log(await getLogs());main();
Right now it:
- Generates scoped, expiring tokens (default 10s)
- Logs every action to kage-keys.log
- Works as a drop-in wrapper for async functions
It’s just an MVP (tokens are fake UUIDs), but I want to see if developers find this helpful before building the production version with real crypto + proxy enforcement.
Repo: https://github.com/kagehq/keys
npm: https://www.npmjs.com/package/@kagehq/keys
Would love feedback, especially from anyone running agents in production or dealing with API key sprawl.
Curious if you'd want to use it?
The short-lived nature means that if the token is leaked or the agent goes rogue, the blast radius is tiny, you can instantly revoke/deny new mints, and you get full audit and policy control. It turns “here’s my permanent master key” into “here’s a disposable permit slip for just this action.”
Let me know if that makes sense.