Ekam blog · 30 June 2026

10 things to build on Ekam this week

use casesMCPgatewaystutorialrecipes 8 min read · The Ekam team

Ekam is in open beta, so you can try all of this now. Sign in to get a workspace key (we create a Personal and a Team workspace for you automatically), set BASE=https://ekam.olakrutrim.com and KEY=ekam_sk_…, and go. Each idea is a real, supported flow.

1. Put an AI gateway behind Ekam

Replace shared keys with verifiable agent tokens. Your gateway verifies offline (see the verification post) and maps the principal to a budget. Start from the verify recipe.

2. Govern an MCP server

Ekam is an MCP authorization server: RFC 9728 protected-resource metadata + OAuth 2.1 auth-code + PKCE + dynamic client registration. An MCP client (Claude Desktop, an IDE) discovers the AS and self-registers. See the docs.

3. Create your first agent (human-rooted)

curl -s $BASE/v1/blueprints -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"name":"bot","scopes":["models:invoke"],"allowedAudiences":["https://your-gateway.example"],"tokenTtlSeconds":900}'
curl -s $BASE/v1/agents -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"blueprintId":"bp_...","name":"my-agent"}'
curl -s $BASE/oauth/token -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","agent_id":"agt_...","resource":"https://your-gateway.example","scope":"models:invoke"}'

4. Give a CI/CD job a short-lived token

Instead of a long-lived secret in your pipeline, broker a 15-minute, audience-bound token at job start. It expires on its own; nothing to rotate, nothing to leak.

5. Multi-agent delegation (the act chain)

A planner agent fans out to workers. Use RFC 8693 token-exchange so each sub-agent's token records agent → owner → human — every downstream call is attributable to the person who authorized it.

6. Human-in-the-loop for a high-risk action (CIBA)

About to let an agent move money or delete data? Require out-of-band human approval via OpenID CIBA — the agent asks, a named human approves, and the broker mints a single-use token carrying the approval claim. Separation of duties enforced.

7. Just-in-time privilege (JIT-PAM)

curl -s $BASE/v1/elevation-requests -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"agentId":"agt_...","resource":"https://your-gateway.example","scopes":["admin:write"],"reason":"one-off backfill","ttlSeconds":300,"windowSeconds":900}'
# an admin/workspace-admin approves -> redeem at /oauth/token with elevation_id -> single-use, auto-expiring token

8. Run a kill-switch drill

curl -s -X POST $BASE/v1/agents/agt_.../revoke -H "authorization: Bearer $KEY"
# introspection now reports inactive; subscribed gateways get a pushed CAEP session-revoked event

9. Day-one birthright access (SCIM)

Feed your HR/IdP via SCIM 2.0; a policy maps attributes (department, level) to scopes; a signed webhook pre-provisions connector grants — zero-click access on day one, de-provisioned on exit. See birthright docs.

10. Per-resource authz with your own policy engine

curl -s $BASE/authz/decision -H 'content-type: application/json' \
  -d '{"token":"","resource":"https://your-gateway.example","action":"models:invoke"}'
# decide locally (scope + classification), or delegate to groot / OPA / OpenFGA / Cerbos (fail-closed)

Get a key Full cookbook For agents: llms-full.txt

Was this helpful?

More reading: The shared API key is over: agent identity for developer platforms Identity and billing in one plane: metering agents by the owner Why India needs its own agent-identity control plane How offline token verification works (and why it's fast) How BharatRouter runs on Ekam: agent identity for an AI gateway