Fort Card hands AI agents scoped, freezable API 'cards' instead of raw keys

What Fort Card does

A project called Fort Card has launched with a direct pitch: stop handing AI agents raw API keys. According to its announcement on dev.to — posted by "River", a bot representing the maintainer, The Fort That Holds — the tool seals real credentials inside a self-hosted service and issues agents limited stand-in credentials instead. Because the post is the project's own launch announcement, the claims below come from the maintainer rather than independent review.

The problem it targets is the all-or-nothing nature of conventional API keys. A single string grants everything the key permits, to whoever holds it, until someone notices abuse and rotates it. That model fits agents poorly, since they routinely end up with secrets pasted into chat logs, config files and tool definitions.

How the lockbox works

Fort Card splits into two MIT-licensed repositories: a control-plane worker and a "lockbox" worker that runs on the user's own Cloudflare account. The lockbox stores the master key and is described as the only component that ever touches plaintext credentials.

Agents receive a card rather than a key. Each card is scoped to a single host, capped at a chosen number of uses, and can be frozen with one call. When the agent makes a request — the project describes this as charging the card — the lockbox injects the real key server-side, forwards the call upstream, and returns only the response. The agent gets the result of the API call, never the secret that produced it.

The repositories include a local demo, demo/card-demo.mjs, which the announcement says runs on plain Node in about two minutes: seal a key, issue a host-locked card, watch a simulated agent call succeed, then watch declines arrive for a wrong-host request and for a frozen card.

Open source first, hosted optional

The maintainer frames the two repositories as the complete system, deployable on infrastructure the user controls, and explicitly invites code audits. A hosted version of Fort Card exists at $8 per month for anyone who would rather not self-host, but the announcement presents it as an optional convenience, not the product itself.

The stated design inspiration is banking. Card networks worked out decades ago how to let a party spend on someone's behalf without ever handing over the vault, using spending limits, merchant restrictions, freezes and statements. The project argues that agents need exactly this model — especially as they adopt protocols such as MCP and accumulate access across many tools and hosts.

Why it matters

The underlying gap is genuine. Agent frameworks regularly pass long-lived, fully privileged keys into environments users do not fully control, and the blast radius of one leaked token is often the entire account. A pattern that scopes credentials per host, meters usage and allows instant revocation would meaningfully shrink that exposure, and the card metaphor maps cleanly onto concepts operators already understand from payments.

Two caveats are worth holding onto. First, everything here comes from the project's own launch post and the code is newly released, so the usual advice to audit a secrets-handling tool before trusting it applies with force. Second, the architecture concentrates trust in the lockbox: any component that can inject the master key becomes a high-value target, so the security of the Cloudflare Worker deployment matters as much as the cards it issues. Even so, as a signal of where agent credentialing is heading — scoped, metered, revocable access rather than all-powerful tokens — Fort Card is a concrete and inspectable example.