Your agent can’t un-see your secrets.

Let your agent work without holding your keys.

We don’t build agents. We make yours safer and simpler. Connect a service once, every agent can use it, and each sensitive action waits for your fingerprint.

Get StartedTry the demo →
Running agents as a team? Agent Identity Solution →
30 seconds: the agent works, you sign.
To add a new agent
claude/.env · newagent/.envBEFORE
# same keys, third agent this month
OPENAI_API_KEY=sk-proj-8Kj2mQ••••••
GITHUB_TOKEN=ghp_hV92xLpT••••••••
pair once
newagent · terminalNOW
$ sc agent add codex
→ approve: safeclaw.pro/pair · code QK7M
✓ paired · 12 services ready · 0 keys pasted
To change an agent’s access
mia@laptop · zshBEFORE
# cut the deploy token from my agents
$ grep -rl RAILWAY_TOKEN ~
47 matches · 3 machines · rotate them all
flip one toggle
console · agents / codexNOW
github
railway· off, everywhere, instantly
When a token expires
agent log · 23:41BEFORE
✗ 401 · google token expired
# third re-auth this month
waiting for you to sign in. again.
you do nothing
safeclaw · daemonNOW
03:12 · agent calls gmail · access token expired
⟳ refreshed in-flight · call went through
✓ agent never paused · you never knew
Ever pasted an API key into an agent’s .env?
Did you hesitate?
You were right to.
Don’t give your secrets to an agent. It’s not safe.
It’s time your secrets had a better home.
Now they live in your own vault: encrypted, on your machine.
Your agent works like before. It just never touches a key.
Get started →
Setup

Just two steps.

01

Store your secrets once

Paste an API key or sign in with OAuth. The credential is sealed by your passkey on your device; only your fingerprint opens it.

sk-••••••••••••→sealed by passkey
02

Set up your agent with one message

Copy one message from your console and paste it to your agent. It wires itself up. Claude Code, Cursor, Codex, all the same.

you
Set up SafeClaw so you can call external APIs with credentials I've stored in it. The CLI is `sc`; its usage guide is the skill at …
the whole thing, copied from your console
your agent
✓ SafeClaw is ready. From here I'll reach Gmail, GitHub and the rest through it.
03

There is no step three.

From here, the agent just works.
Anything sensitive pauses for your face: one glance, and it carries on.
Simple and safe.
LIVE · TRY ITA real approval request: send an email, waiting on Face ID
And one more thing

It also deletes key-pasting from your life.

Connect once. Every agent, on every machine, has it safely.

Your agents
Claude Code
Codex
Cursor
OpenClaw
Gemini CLI
Hermes
＋ any agent plugs in
SafeClaw
keys encrypted in the vault
What they can use
Gmail
Google Calendar
Google Drive
Google Cloud
GitHub
GitLab
Supabase
Railway
Telegram
crates.io
npm
OpenAI
Anthropic
Gemini
Groq
DeepSeek
＋ any API plugs in
1connection
every agent gets it
Connect Gmail once and Claude Code, Cursor, and Codex all have it. New agents plug in with zero re-pasting.
1key per agent
all an agent ever holds
One SafeClaw key buys use of everything. Real keys never enter its config; nothing secret lives in .env.
1sign-in
zero upkeep after
Tokens renew on their own. If one truly dies, you see which and fix it in one place. No hunting through agents.
Get Started
$10/mo, waived during beta · Pricing →
Built for teams

Agent Identity Solution

User, agent and device each hold a separate identity key. Easy to manage, easy to audit.

User Identity
UIK
your passkey, your fingerprint
offboarding re-keys the vault
Agent Identity
AIK
one keypair per agent
revocable per agent
Device Identity
DIK
one keypair per machine
revocable per machine
a credential moves only when all three verify
History · sensitive calls
Approved byUIK
AgentAIK
DeviceDIK
2mPOSTgmail /v1/…/messages/send
Mia Chen
Claude Code
macbook-pro
allowed
14mPOSTgithub /repos/acme/merges
Alex Ito
Codex
build-01
allowed
1hPOSTsupabase /v1/…/backups
Mia Chen
Cursor
macbook-pro
allowed
Containment by design
An agent key works only on its enrolled device. A stolen laptop holds only encrypted data. Losing one key never opens the vault.
Attribution at the protocol level
Every entry records which user approved, which agent acted, and which device carried the call, each under its own key’s signature. The audit log is part of the protocol.
Offboarding, enforced by cryptography
Removing a member re-keys the vault. Everything the team writes afterwards is sealed under keys the former member never held.
Start your team
30-day free trial · no card
Enterprise adds self-hosting and compliance. Team pricing →
Security

Proof, not promises

The architecture, in four sentences.

01
Your keys live on your machine.
Encrypted at rest, sealed by your passkey. The cloud syncs ciphertext it cannot decrypt.
02
Agents hold placeholders, never keys.
The real value is injected at the network edge, on your own machine; the agent process never holds it. What an agent never had, it cannot leak.
03
An approval is a signature.
Your passkey signs the one operation in front of you. The grant binds to its hash and expires on use: replay, swap, forgery all fail.
04
The design is public.
The protocol is published research (SUDP, arXiv). The core is source-available Rust, open to audit.
Signed grant
An approval is a signature, not just a click.
ActionSend one email POST gmail.googleapis.com/…/send
Bound tothis operation's hash
Valid forone execution, then it expires
✗Alter the operation: signature invalid
✗Replay it: already redeemed
✗Forge one: not without your fingerprint
WebAuthn PRF · AES-GCM-256 · SUDP
The grant is defined by SUDP, an open cryptographic protocol with 7 checkable security properties. Not even our own servers can forge one.
Read the paper →
Prefer watching? The whole mechanism, animated.
For the engineers: a real agent call looks like this
your agent, calling Gmail
$ sc run -- curl https://gmail.googleapis.com/gmail/v1/users/me/messages \
    -H "Authorization: Bearer __sc__gmail__"

# on a sensitive call, you tap the link, Face ID:

200 { "messages": [ … ] }
# the placeholder is swapped at the exit; the agent never saw the real key
View the source
Research

Beyond the product.

We study the agent-security space itself.

Incident chronicle
46 agent security incidents, on the record
2025 to now, chronological, facts and sources only.
Read the chronicle →
The protocol paper
SUDP: approval, formalized
Seven checkable security properties, published.
Read the paper →

Give SafeClaw the credentials.
Give your agent the work.

First service in five minutes. Every approval after is one touch.

Get Started
$10/mo, waived during beta · Pricing →
Local-first · Auditable code · Zero-knowledge cloud