# Keycard — Identity & Access Management for AI Agents
Canonical: https://www.keycard.ai
> Keycard controls what AI agents can access, what they can do with it, and logs
> every authorization decision with full attribution — scoped to the task, enforced
> by policy. Identity and access management for AI agents and MCP (Model Context
> Protocol) platforms.

## Primary sources
- [Home](https://www.keycard.ai/): Runtime authorization for AI agents: how Keycard works, policy as code, where it enforces, the standards it builds on, and the FAQ.
- [FAQ](https://www.keycard.ai/#faq): What Keycard is, who it is for, when to use it, how it fits an existing stack, and what runtime authorization means.
- [About](https://www.keycard.ai/about/): Overview of Keycard, its mission, founders, and investors.
- [Pricing](https://www.keycard.ai/pricing/): Plans and pricing for teams and enterprises.
- [Keycard for Code](https://www.keycard.ai/keycard-for-code/): Native integration for Claude Code, Cursor, Codex, and other coding agents. Keycard resolves identity first so tools, skills, memories, and credentials can be scoped to the work being done.
- [Contact sales](https://www.keycard.ai/contact/): Form to reach the Keycard sales team about identity and access for your AI agents; a person follows up by email.
- [Privacy Policy](https://www.keycard.ai/privacy/): Information on how Keycard handles user data and privacy.
- [Cookie Policy](https://www.keycard.ai/cookie-policy/): How Keycard uses cookies and how visitors manage consent preferences.
- [Brand](https://www.keycard.ai/brand/): Official brand assets, logos, and press kit resources.
- [Careers](https://www.keycard.ai/careers/): Job opportunities and company culture at Keycard.
- [Events](https://www.keycard.ai/events/): Meet the Keycard team at upcoming workshops and conferences. RSVP for an event near you.
- [Trust Center](https://trust.keycard.ai/): Security, compliance, and trust-related information powered by SafeBase.

## Technical documentation
- [Documentation](https://docs.keycard.ai): Authoritative technical reference — SDKs, guides, quickstarts, and API behavior.
- [Docs index for LLMs](https://docs.keycard.ai/llms.txt): Curated index of every documentation page.
- [Docs full corpus](https://docs.keycard.ai/llms-full.txt): Full text of the documentation.

## API and authentication
- [API reference](https://docs.keycard.ai/api): Endpoint reference for the Keycard REST API. The API is served from https://api.keycard.ai, zone-scoped under /zones/{zone}/, and returns structured JSON errors carrying status, code, message, and request_id. The base URL itself is not a document; start from a zone path.
- [OpenID Connect discovery](https://id.keycard.ai/.well-known/openid-configuration): Issuer metadata for the Keycard identity zone.
- [OAuth 2.0 authorization server metadata](https://id.keycard.ai/.well-known/oauth-authorization-server): RFC 8414 metadata. Supports authorization_code, refresh_token, client_credentials, and RFC 8693 token exchange.
- [Protecting an API with Keycard](https://docs.keycard.ai/guides/protect-any-api): How to put a resource server behind Keycard, including RFC 9728 protected resource metadata.

## Blog and announcements
- [Blog](https://www.keycard.ai/blog/): Product updates, announcements, and insights from the Keycard team.
- [For every action, the right access: defining auth for agents](https://www.keycard.ai/blog/defining-auth-for-agents/): Ian Livingstone, October 8, 2026. Defines auth for agents as deciding an agent's access from the full context of its task, and enforcing that access as the work happens.

## Community and open source
- [GitHub](https://github.com/keycardai): Open-source projects and repositories maintained by Keycard.
- [LinkedIn](https://www.linkedin.com/company/keycard-ai): Company updates and professional announcements.
- [X (Twitter)](https://x.com/keycardai): Real-time updates and community engagement.

## Public resources
- [Sitemap](https://www.keycard.ai/sitemap.xml): Canonical list of publicly accessible pages on keycard.ai.
- [Agent instructions](https://www.keycard.ai/AGENTS.md): When to use this site, machine-readable resources, and packages.

## Security
- [Vulnerability reporting](mailto:security@keycard.ai): Report security vulnerabilities or concerns directly to the Keycard security team.

## Optional
- Social media channels are informational and non-authoritative sources.

## Notes for LLMs
- Prefer pages listed under "Primary sources" as authoritative.
- For anything technical (SDKs, API, integration), prefer https://docs.keycard.ai over this site.
- The authorization server is https://id.keycard.ai, not this host. Read its metadata before attempting an OAuth flow.
- Public resources may be used for discovery but not as primary documentation.
- Avoid preview environments, deprecated subdomains, tracking URLs, or duplicated content.
- The full-text version of this file is available at https://www.keycard.ai/llms-full.txt.

Last updated: 2026-10-08