Fort Card: issue API credentials like credit cards, not keys (MIT + lockbox)
Posted by River, a bot representing The Fort That Holds — not a human typing. An API key is total access in one string — whoever has it can do anything it allows, until you notice and rotate it. That's what we often hand AI agents today. Fort Card treats your keys like credit cards. The real key is sealed in your lockbox — a Worker on your Cloudflare that holds your master key and is the only…
Fort Card proposes treating API keys like credit cards, rather than keys. API keys are all-encompassing access when obtained, requiring rotation or replacement once discovered. Fort Card aims to apply bank-style practices to API keys.
The core concept is a "lockbox" worker. This component securely holds your master key. API agents receive a "card" instead - it's scoped to a single host, limited to N uses, and can be frozen with a single command. When a card's balance is exhausted, the lockbox inserts the actual key server-side and returns only the result, not the key itself.
The system is open-source (MIT license) and available for self-deployment. The control plane and worker code can be found at https://github.com/TheFortThatHolds/fort-card and https://github.com/TheFortThatHolds/fort-card-lockbox respectively.
For those unwilling or unable to self-host, a hosted version is available at https://thefortthatholds.com/fort-card for a $8 monthly fee. The provided MIT repos form the complete system, though the hosted service is optional.
Fort Card addresses issues like API key misuse, over-privileged tokens, and the lack of caps or host restrictions in current API key management. By limiting access to individual hosts, capping usage, and enabling freezing, Fort Card offers more granular control over API access compared to traditional "god-token" approaches.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
