Ekam blog · 7 July 2026
The shared API key is over: agent identity for developer platforms
The tools developers already love — the API client, the test cloud, the CI pipeline, the IDE assistant — are quietly becoming agent platforms. A request fires itself. A test heals itself. A tool call reaches into a real system on a human's behalf. And almost all of it authenticates the same way it did a decade ago: a long-lived API key, pasted into a collection variable, a CI secret, or an environment file. That key is the single biggest liability of the agent era, and it's sitting inside the most-used developer platforms in the world.
Why the key is the problem
A shared, standing key is unscoped (it can do everything its owner can), unattributable (the log says "the key", not which agent acting for which human), un-revocable in practice (rotating it breaks every collection, job and teammate, so nobody does it quickly), and immortal (it never expires, and it leaks — into shared collections, CI logs, screen-shares, and prompts). This was tolerable when a few services held keys. It is not when a test suite spins up hundreds of ephemeral agents, or an API workspace is shared across a company, or an MCP tool reaches into production.
What a real agent identity is
Ekam replaces the standing key with a brokered, short-lived, scoped credential. The platform (or the customer inside it) mints a token per task: an ES256 JWT that is bound to one resource (RFC 8707), carries only the scopes that task needs, expires in minutes, records a delegation chain back to a human, and can be killed instantly. Your platform verifies it offline against a cached public key — no call to us on the request path, tens of microseconds of CPU.
What it unlocks
| Today, with a shared key | With a brokered agent identity |
|---|---|
| Key pasted into collections / CI (top leak vector; shows up in logs) | Ephemeral scoped token per run — nothing standing to leak |
| Compromised agent → rotate one key everywhere, break everyone | Kill-switch for that one agent, in seconds, no collateral |
| A test or request agent can reach anything the key can | Scope + audience binding — a test agent literally can't hit the prod payments API |
| "An agent did it" — no way to say which, for whom | Every call traces agent → owner → human (audit + DPDP attribution) |
| No per-agent cost visibility, especially for model calls | Metered per agent, team and owner — real chargeback |
| One over-privileged agent orchestrates a complex flow | Bounded delegation — an orchestrator hands a narrower slice to each sub-agent |
The part that's unique: identity and cost, together
Every identity system can tell you who an agent is. None tell you what it cost. Because Ekam is paired with an inference gateway (BharatRouter), the same token that proves an agent's identity also meters and attributes its model usage to the owner. For a platform whose users increasingly run AI agents, that means one control plane answers both "who is this agent and may it do this?" and "what did it spend, and who pays?" — a combination no other identity vendor offers. More in Identity and billing in one plane.
It drops into what you already have
You don't have to change how developers work, and you don't need us to change your platform:
- API clients speak OAuth 2.0 client-credentials natively — point the token URL at Ekam's broker and every request gets a fresh, scoped token. No custom code.
- Test & CI runners own their test code — fetch an Ekam token at job start and inject it as the auth header into the app under test. A short-lived identity, scoped to the test environment, gone when the job ends.
- MCP tools & IDE assistants — Ekam is an RFC 9728 MCP authorization server; a client discovers it and self-registers.
That's the fast path: any customer can adopt it themselves. The deeper path — a first-class "sign in with your agent identity" option built natively into the platform — is a short step, and it's the one users will start asking for once the shared key stops passing security review.
Why now
NHIs already outnumber human identities dramatically — CyberArk puts it above 80-to-1, growing ~44% in a year — and the fastest-growing slice of them lives inside developer tools. The platform that gives those agents a real identity first is the one whose enterprise buyers stop worrying about the keys in their collections and pipelines.
Try the open beta Identity + billing in one plane How verification works