Keycard
Policy-based access control and audit trails for autonomous agents.
About Keycard
Keycard is an access control plane for autonomous agents that connect to tools, APIs, and data. Keycard assigns identities to users, devices, agents, and applications, then evaluates each request against policies before granting narrowly scoped access. Teams can use RBAC, ABAC, and ReBAC, bind applications and dependencies, and inspect real-time telemetry to see which person or agent authorized an action. The service supports OAuth 2.1, Token Exchange, SPIFFE, WIMSE, MCP, A2A, API, CLI, and custom SDK protocols. Pricing is based on transactions, counted when Keycard issues or exchanges a credential, validates access, or handles a step-up approval. Starter is free but stops at 5,000 monthly transactions. Team costs $500 per month with 100,000 transactions, while Enterprise adds organization and device policies, private deployment choices, customer-managed keys, provisioning, continuous export, and 24/7 support. The product is offered through an early-access signup, so teams should account for onboarding availability before planning a rollout.
Best for
Best use cases
Choose Starter for personal testing when a hard monthly transaction cap is acceptable.
Choose Team when usage exceeds 5,000 transactions or the rollout needs SSO and 90-day telemetry.
Choose Enterprise for organization or device policy, private networking, continuous SIEM export, or dedicated support.
Compare before choosing
Starter costs nothing but stops at 5,000 monthly transactions and retains telemetry for 7 days.
Team costs $500 monthly, includes 100,000 transactions, and adds SSO, zone policy, and 90-day retention.
Enterprise uses annual custom pricing and adds private deployment, advanced provisioning, a 99.95% uptime SLA, and 24/7 P1 support.
Features
Govern coding agents
Grant a coding agent task-scoped access to logs, issue trackers, repositories, and production services while blocking requests that violate policy.
Audit multi-agent applications
Record agent and user identity, authorization context, scope, and actions so operators can investigate who accessed a service and why.
Centralize enterprise agent access
Apply organization, zone, device, and relationship policies across agents and applications, with enterprise provisioning and deployment controls.
Pros
- The free Starter plan supports personal evaluation without a subscription charge.
- Multiple authorization models and task-scoped policies reduce the access granted to agents.
- Enterprise deployment, networking, key management, export, and provisioning options fit stricter infrastructure requirements.
Cons
- Starter stops at 5,000 transactions per month, which can interrupt higher-volume evaluations.
- Team starts at $500 per month and charges $1 per 1,000 transactions beyond the included 100,000.
- Access currently begins through an early-access signup, adding uncertainty to rollout timing.
Pricing Plans
Starter
- Unlimited users, agents, and apps
- App Binding and Dependencies policy
- RBAC, ABAC, and ReBAC
- Real-time telemetry with 7-day retention
- Community support
Team
- Everything in Starter
- SSO for organization users
- Zone Policy
- 90-day telemetry retention
- Full usage data and insights
- Email support
Enterprise
- Everything in Team
- Organization and device-based policies
- SCIM, Active Directory, and LDAP provisioning
- Dedicated, BYOC, or on-prem deployment
- Private networking and customer-managed KMS
- Continuous OCSF export
- 24/7 support and dedicated CSM
* Pricing information is for reference only. Please refer to the latest announcement on Keycard's official website.