{ "video": { "id": "YqJ4asgj1R8", "title": "Stop Giving Your AI Agents API Keys - Kim Maida, Keycard & Mason Egger, Temporal", "duration": 3156, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer", "event_format": "" }, "analysis": { "video_id": "YqJ4asgj1R8", "title": "Stop Giving Your AI Agents API Keys - Kim Maida, Keycard & Mason Egger, Temporal", "one_liner": "Replace shared API keys with OAuth 2 token exchange, so each agent tool call gets a short-lived, narrowly scoped token that records both the agent and the user it acts for, then run the agent loop on durable execution so a crash doesn't lose state or repeat LLM calls.", "summary": "Kim Maida of Keycard argues that API keys leave agent actions unattributed and give agents every permission in the key, and that human-in-the-loop is no fix because humans make mistakes and many agents run autonomously. The workshop evolves an expense desk agent from API keys, to its own agent identity, to user delegation, using token exchange (a 2020 standard extending OAuth 2) across two hops: agent to MCP server, and MCP server to ledger API. Mason Egger of Temporal then treats agents as distributed systems, killing a worker mid-settlement and restarting it to show the workflow resume without redoing LLM calls or completed activities. Credentials stay out of Temporal's event history throughout.", "key_points": [ "API keys have three named problems: credentials aren't attributed to a user or agent identity, the agent has unrestricted use of every permission in the key, and human-in-the-loop can't simply be added everywhere.", "Before any token is issued, policy is evaluated against what access is requested from which resource, who the agent is, and who the agent is acting for. An exchange request combines the agent's identity, the user's identity from the subject token, and the access the user delegated through scopes.", "In the demo, the Expense Desk agent exchanges the user's subject token for a token usable only at the expense MCP server, and the MCP server makes a second exchange for a ledger API token. Tokens are scoped to the specific tool call, usually expire within minutes, and are never stored; the MCP server discards its token once the call is done.", "With API keys, the activity log showed only that an API key created or approved an expense. After adding identity, it showed who filed, approved or rejected each one, and Keycard's audit log showed the delegation chain, which can be followed across hops by a shared session number.", "Identity made business rules enforceable: the agent could approve expenses under $50 itself ($49.99 limit) while Kim's human limit was $100, a $30 expense was auto-approved by the agent, a $75 expense stayed pending for human review, and the agent refused to let Kim approve her own expense.", "An agent saying it filed 'on behalf of Kim' proved nothing until she signed in, because that text was only something she had told it. The expense was still recorded under the agent's own identity, which is why user delegation is added as a separate step.", "In Temporal, the agent loop is modeled as a workflow and each tool call as an activity. In the demo, the worker was killed mid-settlement after a $4,200 ledger debit had been recorded, and on restart the workflow replayed its history and continued with no LLM calls or completed activities re-executed.", "Temporal offers two ways to keep sensitive data out of its event history: Keycard's interceptor, a decorator-applied hook that injects credentials just in time, and a payload encoder, a sidecar pattern that encrypts data with keys Temporal doesn't control. A script in the demo confirmed no JWT material appeared in the history." ], "takeaways": [ "Stop handing agents shared API keys: have an OAuth client (a gateway, custom agent app or CLI wrapper) exchange the user's subject token for short-lived, per-tool-call tokens at each hop, and never store them.", "Have agents act on behalf of users rather than impersonate them, so records show that this agent did this thing on behalf of this person with their permissions, while the agent can keep a separate identity and limits for acting on its own.", "Keep agent secrets off disk: store LLM API keys in a vault, and in production use something like workload identity rather than a client ID and secret in an env file.", "Treat agent loops as distributed systems and use durable execution, rather than building your own state persistence, reconstruction and retry logic, so a failure 12 steps in doesn't lose progress or waste tokens.", "Keep credentials out of workflow history by injecting them just in time with an interceptor, and encrypt payloads with a payload encoder, since data otherwise sits in plain text in Temporal's Web UI." ], "topics": [ "agents", "agent identity", "oauth token exchange", "delegation", "mcp", "audit logging", "durable execution", "secrets management" ], "tools": [ "Keycard", "Temporal", "OAuth 2", "MCP", "LangChain", "OpenAI", "Pydantic AI", "Google", "Okta", "Auth0", "GitHub", "Kubernetes", "AWS" ], "quotes": [ { "text": "we can't just sort of stick human in the loop everywhere because humans make mistakes, too, and many agents also run autonomously.", "at": "01:48", "url": "https://www.youtube.com/watch?v=YqJ4asgj1R8&t=108s" }, { "text": "Now this issued token usually expires within minutes and you should never store it.", "at": "07:11", "url": "https://www.youtube.com/watch?v=YqJ4asgj1R8&t=431s" }, { "text": "We want it to say this agent did this thing on behalf of Kim with Kim's permissions.", "at": "31:38", "url": "https://www.youtube.com/watch?v=YqJ4asgj1R8&t=1898s" }, { "text": "Agents are just distributed systems at the end of the day with a little bit of added spice on top with some thinking.", "at": "42:31", "url": "https://www.youtube.com/watch?v=YqJ4asgj1R8&t=2551s" } ], "words": 8861 }, "summary_url": "/#YqJ4asgj1R8", "transcript": { "html": "/transcripts/YqJ4asgj1R8.html", "txt": "/transcripts/YqJ4asgj1R8.txt", "vtt": "/transcripts/YqJ4asgj1R8.vtt" } }