Docs/Getting Started/Quickstart

Quickstart

Get up and running with Keystore in under 5 minutes. Install the SDK, create an agent token, and make your first proxied API call.

Quickstart

Keystore is a credential vault for AI agents. Instead of embedding raw API keys in your agent code, you use a ks_ agent token. Keystore resolves the real credentials at request time and forwards the call to the provider.

This guide walks you through the full setup in under 5 minutes.

1. Install the SDK

bash
1
npm install @keystore/sdk

2. Create an account

Sign up at the Keystore Dashboard and create a project.

3. Add a provider credential

In the dashboard, navigate to Providers and add the API key for the service your agent needs (e.g., OpenAI, Anthropic, Neon). Keystore encrypts it with AES-256-GCM and stores only the ciphertext.

4. Create an agent token

Go to Agent Tokens and create a new token. You will receive a token that looks like this:

1
ks_a1b2c3d4e5f6...

Copy it immediately — it is only shown once. This token is what your agent uses instead of real API keys.

5. Use the SDK

The fastest way to integrate is interceptAll(). It patches globalThis.fetch so that any request to a supported provider API is automatically routed through the Keystore proxy.

typescript
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import { Keystore } from "@keystore/sdk";
import OpenAI from "openai";

const ks = new Keystore({ agentToken: "ks_a1b2c3d4e5f6..." });

// Intercept all outgoing requests to supported providers
ks.interceptAll();

// Use the OpenAI SDK as normal — the apiKey value is ignored
const openai = new OpenAI({ apiKey: "unused" });

const response = await openai.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Hello from Keystore!" }],
});

console.log(response.choices[0].message.content);

// Restore original fetch when done
ks.restore();

That is it. The OpenAI SDK thinks it is talking to api.openai.com, but Keystore intercepts the request, injects your real API key, and forwards it. Your agent code never sees the actual secret.

6. Alternative: Wrap a single client

If you prefer explicit control over which clients are proxied, use wrap() instead:

typescript
1
2
3
4
5
6
7
8
9
10
11
import { Keystore } from "@keystore/sdk";
import OpenAI from "openai";

const ks = new Keystore({ agentToken: "ks_a1b2c3d4e5f6..." });

const openai = ks.wrap(new OpenAI({ apiKey: "unused" }));

const response = await openai.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Hello!" }],
});

Next steps

Next
Installation →