AI Credential & Integration Gateway

The gateway sits between your AI agents and your systems. Agents request short-lived, brokered access to providers like OpenAI, GitHub, Slack and AWS — scoped, optionally human-approved, and fully audited. The real credentials stay encrypted in the vault and are injected at the moment of use. The agent never holds a raw key.

The building blocks

Concept	What it is
Agent	A non-human identity (a bot, an AI coding agent) with its own scoped policy — distinct from your human account.
Tool	A registered provider an agent can reach (OpenAI, GitHub, Slack…). Holds the broker credential config, never exposed to the agent.
Broker session	A short-lived grant to call one tool. The agent uses the session — never the underlying key.
Approval	A human-in-the-loop gate. Sensitive tools require a person to approve before the session activates.
Workflow	A pipeline chaining brokered tool calls, with approval gates and resume.
Prompt history	A record of agent interactions you can inspect and replay.

Two ways to broker access

Proxy mode

The agent sends its request to MeowPass, which injects the real key server-sideand forwards it to the provider. The key is never present in the agent's process. Best for API-key providers like OpenAI.

Native-temp mode

MeowPass mints a provider-native short-lived credential (e.g. a GitHub App installation token) and hands that to the agent. It expires on its own — nothing long-lived leaks. Best for providers with native temporary tokens.

Quick start: broker an OpenAI call

1. Register the tool and its credential

The credential is encrypted server-side. Agents can call the tool but never read this value.

# Register the tool curl -X POST https://api.meowpass.dev/tools \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d '{"name":"openai","base_url":"https://api.openai.com","mode":"proxy"}' # → { "id": "tool_...", ... } # Attach the real API key (stored encrypted, never returned) curl -X PUT https://api.meowpass.dev/tools/tool_.../credential \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d '{"header":"Authorization","value":"Bearer sk-..."}'

2. Create an agent identity

Scoped agent

curl -X POST https://api.meowpass.dev/agents \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d '{"name":"support-bot"}' # → returns an agent token; store it as the agent's credential

3. Agent requests a broker session

As the agent

curl -X POST https://api.meowpass.dev/broker/sessions \ -H "Authorization: Bearer $AGENT_TOKEN" \ -d '{"tool_id":"tool_..."}' # → { "id": "sess_...", "status": "active" } # (status is "pending_approval" if the tool requires a human gate)

4. Call the provider through the session

The agent hits the proxy path — MeowPass injects the real key and forwards upstream.

Proxy request

curl -X POST \ https://api.meowpass.dev/broker/sessions/sess_.../proxy/v1/chat/completions \ -H "Authorization: Bearer $AGENT_TOKEN" \ -d '{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}' # → OpenAI's response. The sk-... key never touched the agent.

For native-temp providers, call POST /broker/sessions/{id}/credential instead — you get back a short-lived provider token to use directly.

Human-in-the-loop approval

Mark a tool as sensitive and every session request lands in a pending queue. A human reviews it in the dashboard (or via API) before the agent gets access. Agents can request; only people can approve.

Human decides

# List what's waiting curl https://api.meowpass.dev/approvals \ -H "Authorization: Bearer $MEOWPASS_TOKEN" # Approve (or reject) a request curl -X POST https://api.meowpass.dev/approvals/appr_.../approve \ -H "Authorization: Bearer $MEOWPASS_TOKEN"

Workflows

Chain multiple brokered tool calls into a single pipeline. Workflows can pause on an approval gate and be resumed once a human signs off.

Define, run, resume

# Create a workflow (steps chain brokered tool calls) curl -X POST https://api.meowpass.dev/workflows \ -H "Authorization: Bearer $MEOWPASS_TOKEN" \ -d @workflow.json # Run it curl -X POST https://api.meowpass.dev/workflows/wf_.../run \ -H "Authorization: Bearer $AGENT_TOKEN" # → { "run_id": "run_...", "status": "running" | "awaiting_approval" } # Inspect a run curl https://api.meowpass.dev/workflow-runs/run_... \ -H "Authorization: Bearer $MEOWPASS_TOKEN" # Resume after approval curl -X POST https://api.meowpass.dev/workflow-runs/run_.../resume \ -H "Authorization: Bearer $MEOWPASS_TOKEN"

Prompt history & replay

Every agent interaction can be captured, inspected, and replayed — useful for debugging agent behaviour and auditing what an agent actually did.

Inspect and replay

curl https://api.meowpass.dev/prompts \ -H "Authorization: Bearer $MEOWPASS_TOKEN" curl -X POST https://api.meowpass.dev/prompts/prompt_.../replay \ -H "Authorization: Bearer $MEOWPASS_TOKEN"

Least-privilege scopes

Every gateway route is guarded by a resource:action scope. Agent policies grant a subset; wildcards (broker:*, *:read) are supported. Human account owners are unrestricted, so an empty scope set means full access (backwards-compatible).

Scope	Grants
agents:read / agents:write / agents:admin	List agents · manage agents · edit agent policies
tools:read / tools:write	Discover tools · register + configure tools and credentials
broker:read / broker:write	List sessions + approvals · request, proxy, and revoke sessions
workflows:read / workflows:write	Inspect runs · create, run, and resume workflows
prompts:read / prompts:write	Inspect prompt history · create and replay prompts
secrets:* / vaults:* / audit:read	The classic vault scopes still apply

The dashboard

Everything above has a web UI at app.meowpass.dev. Sign in with your MeowPass identity (OIDC) to browse agents, live broker sessions, the pending approval queue, prompt history, and the full audit trail. Approving a session request is one click.

Security model

• The real credential is encrypted server-side and injected at call time — it is never returned to an agent.
• Broker sessions are short-lived and individually revocable (DELETE /broker/sessions/{id}).
• Sensitive tools require human approval before a session activates.
• Proxy paths reject traversal (..) and every broker call is written to the audit log.
• Agents carry least-privilege scopes; a compromised agent can be disabled instantly (PATCH /agents/{id}/status).
• The secret vault is separate — the gateway's broker credentials are a distinct, purpose-built store.