Interactive demo

See the vault in action.

Three steps to keyless agents. Install, configure, ship. Your code stays the same — Keystore handles the rest.

$npm install @keystore/sdk
1

Choose your integration method

Patch globalThis.fetch — all SDK calls route through the vault automatically.

agent.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import Keystore from "@keystore/sdk";
import OpenAI from "openai";
import Anthropic from "@anthropic-ai/sdk";

const ks = new Keystore({ agentToken: process.env.KS_TOKEN! });

// One line. Every service call now routes through the vault.
ks.interceptAll();

// Use SDKs as normal — keys are resolved at request time.
const openai = new OpenAI();
const claude = new Anthropic();

const res = await openai.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Hello" }],
});

// Done. Call ks.restore() when finished.
ks.restore();
2

Watch a request flow through the vault

1
Agent calls SDK
openai.chat.completions.create({ ... })
2
Fetch intercepted
api.openai.com → vault.keystore.com
3
Vault resolves key
ks_token → validate → decrypt AES-256-GCM
4
Request forwarded
Real key injected → api.openai.com
5
Response returned
Agent receives response. Never saw the real key.
3

What your agent sees vs. what it doesn't

Agent's view
KS_TOKEN=ks_a1b2c3...
vault.keystore.com/v1/openai
Response from GPT-4o
Hidden from agent
sk-proj-4f8b2c...
sk-ant-api03-7d9e...
postgresql://user:pass@...

Works with your stack

LangChain
setupEnv()
CrewAI
setupEnv()
OpenAI SDK
wrap() / interceptAll()
Anthropic SDK
wrap() / interceptAll()
Vercel AI SDK
interceptAll()
AutoGPT
setupEnv()
Custom agents
OpenClaw prompt
Any HTTP client
OpenClaw prompt

Ready to vault your keys?

Get started in under 5 minutes. No credit card required.