One vault, many devices
Instead of a key on every laptop, keep one key in the vault and issue each device a token. A device that gets lost stops working the moment you revoke its token — the provider key stays intact and untouched.
Per-agent budgets
Two agents should not share one bottomless key. Give each agent a daily or per-run token budget, and the platform stops the expensive one before it burns through the shared allowance.
Approvals for sensitive actions
For destructive or expensive steps you can require a confirmation. This is less about the key and more about the agent’s behaviour, but it closes the loop: a stolen token alone cannot trigger a wipe without a human in the chain.
Rotation without the pain
Rotation means pasting a new key once. Because devices hold tokens rather than the key, they pick up the change automatically on the next request. You never SSH into a box to edit a config.
What a good setup looks like
- Keys in the vault, never on disk.
- One token per device, each independently revocable.
- Budgets and approval rules per agent.
- An audit trail showing every call and its cost.
- Rotation scheduled, not only after incidents.