Features

Everything we do, and what each one covers. Pick a service to read the full detail.

The broker

The broker

An AI coding agent that can run commands can print any credential in its reach. The usual answer is a blocklist of ways to print an environment, and that list is not enumerable: an interpreter one-liner, a script's error output, a tool logging its own config, a test fixture. The fix is absence.

We offer:

  • Identity read from the kernel per connection, never from a header
  • Method and path checked against a per-service allowlist
  • A rate limit per caller, per key
  • The credential injected on the way out and stripped from anything coming back
  • One audit line per call, refusals included
More about The broker
Keys, labels and callers

Keys, labels and callers

"Max may use the company account; the build service may not" is a sentence one-key-per-service cannot express, and a broker that cannot express it hands out the more privileged key by default. So permission is per key, not per service.

We offer:

  • Several keys per service, each under its own label
  • A list of callers permitted per key, mandatory, never empty
  • A per-minute rate limit per caller, per key
  • Optional narrowing of a service's allowed endpoints, never a widening
  • A version per key block, carried into every audit line
More about Keys, labels and callers
The public catalogue

The public catalogue

Two files, and only one of them holds a secret. The catalogue is public and ships with the binary: what each service is, its base URL, whether the key travels in a header or a query parameter, and which methods and paths are allowed. The config is private, root-owned, and holds your keys and who may use them.

We offer:

  • One public entry per service: base URL, where the credential goes, allowed endpoints
  • HTTPS only — a plain-HTTP base URL is refused at load
  • Header or query injection, never both; the one the entry names
  • Strip, then set: a caller cannot slip its own value beside ours
  • Credential slots and connection headers the caller can never send
More about The public catalogue
The audit line

The audit line

A broker that logged only successes would make a caller probing the allowlist invisible, which is exactly the traffic worth seeing. So every exit writes a line — forwarded, refused as unknown, refused as not permitted, refused as off-policy, rate-limited, upstream unreachable — with the same fields.

We offer:

  • Caller and uid, from the kernel
  • The upstream by label, so spend is attributable to one account
  • Method, path up to the first question mark, status, bytes in and out, duration
  • A policy id carrying the key block's version
  • Refusals logged with the same fields as successes
More about The audit line
Install and rotate

Install and rotate

The installer runs as root once, is idempotent, and never touches a credential. It creates the config empty and root-owned; keys go in afterwards. Adding one prompts on the terminal with echo off.

We offer:

  • install.sh creates the service user, the client group, the binary, the catalogue and an empty config
  • systemd owns the socket: mode 0660, group authinjector-clients
  • authinjector add prompts with echo off; import reads a file whose permissions it checks
  • An existing key is never replaced by accident — replacing is a deliberate flag
  • Static binaries for amd64 and arm64; no runtime dependencies
More about Install and rotate

Ready when you are.

Tell us about your setup and a person will write back.

Get in touch