Skip to content

Give agents API access without giving them your secrets.

Vault provider keys once, mint scoped vtx_session_* keychains for each agent, and route every call through Vertex. You control what each agent can use — then see exactly which services it touched, how often, and whether each request was allowed, blocked, or failed.

Start with VertexReview security model
<150ms
Median proxy overhead
ES256 + token
Layered agent identity
0
Secrets in agent context
live · agent activity5 keychains · monitored
  • deploy-bot→Stripe · sk_live09:42allowed
    $420 / $500 cap
  • support-agent→Linear · issues09:41allowed
  • ops-bot→GitHub · delete_repo09:38blocked
    tool denied
  • data-agent→file-upload.io09:35blocked
    egress denied
  • data-sync→Supabase · rows09:33allowed
calls today
12,840
blocked
37
secrets exposed
0

No secret sprawl

Agents receive short-lived vtx_session_* keychains. Production provider keys stay vaulted and never leave the server.

MCP-aware policy

Typed inspection of tools/call lets you deny stripe.create_payout, cap the agent's daily spend wallet, and taint sessions after untrusted reads.

Agent activity you can see

Monitor which services each agent uses, how often, what was allowed or blocked, and which keychain made the request.

Multi-tenant ready

Server-to-server keychain issuance API for B2B AI products that hold their customers' keys.

Why teams buy Vertex

Manage agent access and see what every agent is doing.

Vertex sits between your agents and external APIs. It keeps provider credentials out of the agent runtime, limits what each keychain can access, and gives operators a live record of activity, usage, blocked requests, and credential use.

Agent API brokerage

Autonomous agents call GitHub, Stripe, Linear, or internal APIs through scoped keychains — no raw production credentials in the agent runtime.

B2B AI products holding customer keys

Mint a Vertex keychain per end-user. Per-tenant audit, scoped tool/domain policy, instant revoke.

MCP server policy layer

Drop Vertex in front of any MCP server. Allow / deny tools by namespace, bind tools to domains, taint sessions after risky reads.

Agent monitoring

Usage charts and audit rows show what each agent accessed, which credentials it used, how often, and where policy blocked it.

Two lines from your agent runtime

Swap the provider host for Vertex. Send the keychain. Audit by default.

TypeScriptvertex-blue-client
import { VertexClient } from "vertex-blue-client";

const vertex = new VertexClient({
  keychain: process.env.VTX_SESSION_KEY!,
});

const res = await vertex.proxy(
  "https://api.stripe.com/v1/charges",
  { method: "POST", body: { amount: 4200, currency: "usd" } },
);
Multi-tenant issuancePOST /api/v1/keychains
curl -X POST https://www.vertex.blue/api/v1/keychains \
  -H "Authorization: Bearer $VTX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "your-customer-uuid",
    "service_ids": ["3f1c9a2e-0b7d-4e6a-9c11-2a8f5d4b7e90"],
    "policy": { "max_spend_cents": 50000, "ttl_minutes": 60 }
  }'
Security architecture

Four checkpoints between your secrets and a breach.

  1. 01

    Locked to you

    A stolen agent key still does only what you allowed — nothing more, nowhere else.

  2. 02

    Bad moves blocked

    Abuse, runaway loops, and overspend are stopped before a single provider call goes out.

  3. 03

    Secrets stay hidden

    Your real keys appear for an instant in memory, then vanish — never written, never logged.

  4. 04

    Proof you can check

    Every action is recorded in a tamper-evident chain, so one altered record is obvious.

Operational view

A live console for every agent route, credential, and blocked request.

recent agent callslive
  • 09:42GitHub issue syncallowed
  • 09:40Stripe invoice draftallowed
  • 09:38Cloud metadata probeblocked
Plans

Start small, then put every agent action behind policy.

Solo dev shipping a product

Developer

$19/mo
  • 100 stored keys · 3 active keychains
  • 100,000 routed calls / mo
  • 30-day audit retention
Start Developer
Most popularTeams in production

Business

$99/mo
  • Unlimited stored keys · 25 active keychains · 5 seats
  • 1,000,000 routed calls / mo
  • 365-day audit retention
  • Priority email support
Start Business
TailoredRegulated agent fleets

Enterprise

Custom
  • Volume pricing & custom quotas
  • SSO / SAML & SCIM
  • On-prem proxy option
  • Dedicated support & SLA

Ship agent capabilities without shipping secret risk.

Put a zero-trust proxy between autonomous execution and every production API.

Sign up now