Scripts and AI agents already touch your production data. They authenticate with keys that never expire, that nobody fully inventories, and that leave no trace of what they touched. This is an early, honest take on a problem the whole industry is still squinting at — not a finished answer.
Every team is wiring AI into its stack this year. Underneath the demos, a quieter thing is happening: the number of non-human actors — cron jobs, CI pipelines, internal scripts, and now autonomous agents — reaching into production is climbing fast. Each one needs to authenticate, and today that almost always means a long-lived API key or token.
Those keys are the same failure shape as every other static credential, only worse: they rarely expire, they're copied into config and prompts and notebooks, and when one leaks you often can't say what it touched. The question a CISO can already feel coming — "which agent read customer X's data last week?" — mostly has no answer yet.
We'd rather you know exactly what you're looking at. The core works: the command-line flow mints a scoped, short-lived, ledgered identity for a non-human actor, with no static secret — you can see it run. What's not ready: the smooth connector that drops this into your existing CI or agent framework (OIDC) is still in progress, not generally available, so plugging it into a real pipeline takes hands-on work with us right now.
And a boundary we hold on purpose: NoAPIKey gives an actor an identity and a scope. It is not a full non-human-identity governance suite — it doesn't discover and inventory every machine identity across your estate. That's a real category, and it isn't what we're building. If that's your need, we'll say so.
This is a design-partner stage, in plain words. If the problem is live for you, the honest move is to build the first real deployment together.
Is the non-human wave already at your door?
Tick what's true. Nothing is sent — this is for you.
Then we should talk — as design partners, not as a sale. And we genuinely want the parts where our take is wrong.
Start the conversation →Reach for us when you want the same sovereign primitive for a machine that we give a person — a scoped, expiring, logged identity that keeps the actor off static keys and on your ledger — and you're willing to shape an early product with us on a problem that genuinely isn't settled.
Reach for someone else when you need machine-identity discovery, inventory, and governance across a large estate today, off the shelf — that's a mature category and it isn't us. We'd rather point you there than oversell.
A choice among several, and an early one — which is exactly why we're asking for your critique instead of your signature. What we don't do yet is on honest limits.
A non-human actor and a person get identity the same way here — that's the point, not a coincidence. The human doors are further along: NoKey for engineers on machines, NoSecret for CI that deploys. See the whole shape on the solutions map.