Non-human identities for scripts, pipelines, bots, and AI agents
Stop sharing credentials between automated systems. Agent Identities give each non-human actor its own scoped token, auditable trail, and zero-knowledge encryption — so you can revoke one agent without disrupting the rest.
First-class non-human identity management built on the same zero-knowledge encryption that protects your human users.
Each agent gets its own unique identity — no more sharing credentials between scripts, pipelines, and bots.
Agents receive their own API token, scoped to specific deployment profiles. Revoke one without affecting others.
Agent tokens carry an encrypted copy of the master key. Secrets are decrypted client-side, never exposed to the server.
Agents can read secrets from assigned profiles but cannot manage users, change settings, or access other profiles.
Set optional expiration dates on agent tokens. Activate, deactivate, or delete agents at any time.
Every agent action is logged with the agent's identity — see exactly which agent accessed which secret and when.
Set up an agent identity in under a minute.
Navigate to the Agents page and click Create. Give your agent a descriptive name (e.g., "CI/CD Pipeline" or "Staging Deploy Bot") and optionally set an expiration date.
The agent's API token is shown once at creation. Copy it immediately and store it securely — you won't be able to see it again.
Add the agent to groups that have access to the deployment profiles it needs. Agents inherit the group's profile access.
Use the token with the CLI or API to authenticate as the agent. The agent can then read secrets from its assigned profiles.
Agents have scoped, least-privilege access. They can read secrets they need — nothing more.
Authenticate your automated systems with a single command.
# Authenticate with an agent identity token
api-stronghold-cli auth api-user --token <AGENT_TOKEN>
# Pull secrets for a deployment profile
api-stronghold-cli env pull --profile production# In your Dockerfile or CI script
ENV API_STRONGHOLD_TOKEN=$AGENT_TOKEN
RUN api-stronghold-cli auth api-user --token $API_STRONGHOLD_TOKEN
RUN api-stronghold-cli env pull --profile production -o .env# .github/workflows/deploy.yml
- name: Authenticate with API Stronghold
run: api-stronghold-cli auth api-user --token ${{ secrets.AGENT_TOKEN }}
- name: Pull production secrets
run: api-stronghold-cli env pull --profile production -o .envGive every automated system its own identity, its own token, and its own audit trail.