AI Credential & Integration Gateway

Controlled access for AI tools. An agent should not hold your API keys. It should ask for access to a specific tool, get a scoped and time-limited session, and leave a record. MeowPass sits in front of your credentials and grants access on those terms. The real credentials stay encrypted, and the agent never receives the raw key unless you explicitly allow it.

The building blocks

Concept	What it is
Agent	An identity. Each agent (a bot, an AI coding agent) has its own policy that says which tools and scopes it can use, distinct from your human account.
Tool	A registered provider an agent can reach (OpenAI, GitHub, Slack). A tool defines what it needs and whether a human has to approve its use. Its credential is never exposed to the agent.
Broker session	A session scoped to one tool that expires. The agent uses the session, not the underlying key, and you can revoke it early.
Approval	Sensitive tools wait for a human to approve the request before the session activates.
Workflow	A pipeline chaining brokered tool calls, with approval gates and resume.
Prompt history	A record of agent interactions you can inspect and replay.

Two ways to broker access

Proxy mode

The agent sends its request to MeowPass, which makes the call with the real key added server-sideand forwards it to the provider. The key is never present in the agent's process. Best for API-key providers like OpenAI.

Native-temp mode

MeowPass mints a short-lived provider token (such as a GitHub App installation token or an AWS STS credential) and hands that to the agent. It expires on its own, so nothing long-lived leaks. Best for providers with native temporary tokens.

Quick start: broker an OpenAI call

1. Register the tool and its credential

The credential is encrypted server-side. Agents can call the tool but never read this value.

# Register the tool curl -X POST https://api.meowpass.dev/tools \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d '{"name":"openai","base_url":"https://api.openai.com","mode":"proxy"}' # → { "id": "tool_...", ... } # Attach the real API key (stored encrypted, never returned) curl -X PUT https://api.meowpass.dev/tools/tool_.../credential \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d '{"header":"Authorization","value":"Bearer sk-..."}'

2. Create an agent identity

Scoped agent

curl -X POST https://api.meowpass.dev/agents \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d '{"name":"support-bot"}' # → returns an agent token; store it as the agent's credential

3. Agent requests a broker session

As the agent

curl -X POST https://api.meowpass.dev/broker/sessions \ -H "Authorization: Bearer $AGENT_TOKEN" \ -d '{"tool_id":"tool_..."}' # → { "id": "sess_...", "status": "active" } # (status is "pending_approval" if the tool requires a human gate)

4. Call the provider through the session

The agent hits the proxy path, and MeowPass adds the real key server-side and forwards upstream.

Proxy request

curl -X POST \ https://api.meowpass.dev/broker/sessions/sess_.../proxy/v1/chat/completions \ -H "Authorization: Bearer $AGENT_TOKEN" \ -d '{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}' # → OpenAI's response. The sk-... key never touched the agent.

For native-temp providers, call POST /broker/sessions/{id}/credential instead. You get back a short-lived provider token to use directly.

Human-in-the-loop approval

Mark a tool as sensitive and every session request lands in a pending queue. A human reviews it in the dashboard (or via API) before the agent gets access. Agents can request access. Only people can approve it.

Human decides

# List what's waiting curl https://api.meowpass.dev/approvals \ -H "Authorization: Bearer $MEOWPASS_TOKEN" # Approve (or reject) a request curl -X POST https://api.meowpass.dev/approvals/appr_.../approve \ -H "Authorization: Bearer $MEOWPASS_TOKEN"

Workflows

Chain multiple brokered tool calls into a single pipeline. Workflows can pause on an approval gate and be resumed once a human signs off.

Define, run, resume

# Create a workflow (steps chain brokered tool calls) curl -X POST https://api.meowpass.dev/workflows \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d @workflow.json # Run it curl -X POST https://api.meowpass.dev/workflows/wf_.../run \ -H "Authorization: Bearer $AGENT_TOKEN" # → { "run_id": "run_...", "status": "running" | "awaiting_approval" } # Inspect a run curl https://api.meowpass.dev/workflow-runs/run_... \ -H "Authorization: Bearer $MEOWPASS_TOKEN" # Resume after approval curl -X POST https://api.meowpass.dev/workflow-runs/run_.../resume \ -H "Authorization: Bearer $MEOWPASS_TOKEN"

Prompt history & replay

Every agent interaction can be captured, inspected, and replayed. This helps with debugging agent behaviour and auditing what an agent actually did. Every call and prompt is logged and attributed to the agent.

Inspect and replay

curl https://api.meowpass.dev/prompts \ -H "Authorization: Bearer $MEOWPASS_TOKEN" curl -X POST https://api.meowpass.dev/prompts/prompt_.../replay \ -H "Authorization: Bearer $MEOWPASS_TOKEN"

Least-privilege scopes

Every gateway route is guarded by a resource:action scope. Agent policies grant a subset; wildcards (broker:*, *:read) are supported. Human account owners are unrestricted, so an empty scope set means full access (backwards-compatible).

Scope	Grants
agents:read / agents:write / agents:admin	List agents · manage agents · edit agent policies
tools:read / tools:write	Discover tools · register + configure tools and credentials
broker:read / broker:write	List sessions + approvals · request, proxy, and revoke sessions
workflows:read / workflows:write	Inspect runs · create, run, and resume workflows
prompts:read / prompts:write	Inspect prompt history · create and replay prompts
secrets:* / vaults:* / audit:read	The classic vault scopes still apply

The dashboard

Everything above has a web UI at app.meowpass.dev. Sign in with your MeowPass identity (OIDC) to browse agents, live broker sessions, the pending approval queue, prompt history, and the full audit trail. Approving a session request is one click.

Security model

• The real credential is encrypted server-side and added at call time. It is never returned to an agent.
• Broker sessions are short-lived and individually revocable (DELETE /broker/sessions/{id}).
• Sensitive tools require human approval before a session activates.
• Proxy paths reject traversal (..) and every broker call is written to the audit log.
• Agents carry least-privilege scopes; a compromised agent can be disabled instantly (PATCH /agents/{id}/status).
• The secret vault is separate. The gateway's broker credentials are a distinct, purpose-built store.