Agent Auth 101: Keycard's Kamil Potrec on Per-Agent Identity and Scoped Credentials
AI Engineer · youtube · 2026-10-28
AI Engineer published "Agent Auth 101," a talk by Kamil Potrec of Keycard on how agents should authenticate.
The problem today
- Agents grab credentials via personal tokens, static keys, and over-privileged service accounts
- When an agent sends an invoice with your token, "who actually made this request?" is unanswerable
What proper agent auth requires
- Per-agent identity
- Delegation plus short-lived, scoped credentials
- Federation with legacy systems, policy controls, and audit
SDKs vs gateways
- SDKs alone can't keep credentials out of an agent's reach
- Gateways can isolate credentials but come with real tradeoffs
- Potrec also covers Keycard's approach and the Agent Baseline project
More from coding & agent
- .NET Channel to Livestream on Foundry Hosted Agents and Agent Memory — lee_stott · 2026-10-28
- Matt Pocock: Agents need a "black hole of success," not a pit — mattpocockuk · 2026-10-28
- Run a coding agent in your browser: LFM3-1.7B hits 300+ tok/s on M4 Max via WebGPU — victormustar · 2026-10-28
- BeeNara v0.4: 332MB local doc sorter hits 91.5% on unseen folders — razer_psycho · 2026-10-28
- AI coding best practices: spec-driven development beats pure vibe coding — sujingshen · 2026-10-28
- Dev questions usefulness of 'Skills': 'it made my agent dumber' — ddaydrm · 2026-10-28