Keycard and Temporal Demo Token Exchange Replacing Static Agent API Keys

Kim Maida of Keycard and Mason Egger of Temporal demonstrated replacing a static API key with expiring tokens in an AI agent demo on AI Engineer, StartupHub.ai reported on November 6, 2026. The Expense Desk agent had held unrestricted permissions to the Ledger API through the Expense MCP server.

How the Token Exchange Demo Worked

Maida traced the fix to Token Exchange, an open standard since 2020 that extends OAuth 2. The flow issues a subject token for the principal and exchanges it through Keycloak's Security Token Service. The issued access token expires within minutes and should never be stored on disk.

"The agent has unrestricted access to any and all permissions in that API key," Maida said. Her workshop moved step by step from an unidentified agent to an agent with its own identity to delegated human identity.

The stack included Keycard Vault to keep LLM keys off disk, the Keycard CLI to populate secrets dynamically, the Keycard SDK mint function to request the exchange, and the Keycard Console to audit applications, resources and activity logs. Egger paired that with Temporal's Durable Execution Framework, in which workflows define parent logic and Activities run child tasks that can fail and retry. A native Interceptor injects identity and permissions, the Worker-Server model rebuilds state after failure, the Temporal Web UI shows history, and a Payload Encoder encrypts that history.

Egger said no LLM calls were redone and no previous Activities were re-executed after a worker failure. He cited integrations with OpenAI, Pydantic AI, LangChain and an agentic harness. The workshop runs in a pre-provisioned shared Keycard organization and sandbox with admin access and checkpoints for each lesson, fronted by an Expense MCP server and a custom LangChain Expense Desk app tied to the Ledger database.

Keycard's Early Access Numbers

According to akta.pro company records, Keycard opened an early access program for the platform, onboarding approximately 127 developers and processing about 2,847 agent requests per day. The same records give a 98.0% success rate for agent requests going through Keycard. Keycard also launched Keycard for Multi-Agent Apps, extending the control plane from single-agent to multi-agent orchestration use cases, and achieved SOC 2 Type II certification.

Other Agent Security Launches

Edera announced Object Capability Bounded Authority on November 5, 2026, granting agents narrowly defined permissions without exposing credentials, PR Newswire reported. BlueFlag Security expanded its AI Agent Governance platform on November 4, 2026, and said its survey found 83% of organizations run unapproved AI coding agents, Help Net Security reported. Skyhigh Security launched Hybrid Mesh SSE on October 28, 2026, Financial Post reported.

What Comes Next for Delegation

The next checkpoint in the workshop is human user identity and delegation. Outside the demo, Microsoft Entra now creates agent identity from a blueprint that holds credentials and mints identities per tenant.