AgentKeyGate

Free, self-hosted gateway that lets your agents use your APIs without ever seeing your keys. Core capabilities: • Time-limited and call-limited access passes • Approval requests via Telegram, Slack, or web • Automatic key injection on every call • Passes close when time or call limits run out • Instant revocation per pass or per agent • Response filtering for CRM data fields • Apache-2.0 licensed, runs on your own server. Agents routinely read .env files and can be tricked by prompt injection into leaking credentials. With AgentKeyGate, the agent names the service, duration, call count, and reason for access. You approve or deny with full context, and the gateway adds your key to each request, counts usage, and filters responses. The key stays out of the agent's memory entirely. CRM integrations default to read-only. You choose exactly which data types and fields are visible, and everything else is stripped from responses before the agent receives them. Revoke any pass or agent at any time, effective on the next call, and review a clear record of every approved request. Built for developers and teams running agents against Bitrix24, CRMs, and other business APIs who want least-privilege access without sharing full-rights keys. Self-hosting keeps credentials on your own infrastructure.