A firewall for your API keys.
Your team and AI agents — Codex, Claude Code, Cursor — need data from your most critical systems. RelayKey gives them scoped, audited access in seconds, revocable in one click — with email confirmation on every new IP, like 2FA for an API key. Your master keys stay locked up.
$ curl -H "Authorization: Bearer rk_proxy_t9xQ...2vZk" \ https://proxy.relaykey.ai/conn_hubspot/contacts { "results": [ { "id": "401", "email": "ana@example.com" }, { "id": "402", "email": "ben@example.com" } ], "next": "405" }
- Methods
- GET
- Expires in
- 23h 12m
- Scope
- /crm/v3/objects/contacts/*
Onboard a person, not a key.
Issue Kate one RelayKey token. Behind it, scope her access to HiBob (read employees), Absorb (read enrollments), and Greenhouse (read jobs). She uses one credential everywhere. When the engagement ends, you revoke one token.
- Per-tool scope. GET-only on HiBob, GET + POST on Greenhouse — different rules per integration, same token.
- Audit per person. Every call is recorded against Kate, across tools. Filter by recipient or by integration.
- One-click offboarding. Engagement over? Revoke the recipient and access to all their tools dies in the same moment.
- 2FA for APIs. First IP gets auto-trusted on setup; every new IP after that needs email confirmation. Stolen tokens fail at the network the recipient doesn't use.
- Agent-ready. RelayKey automatically generates a copy-pasteable prompt for Codex, Cursor, Claude, or any other agent. Wired up in one step.
- Master keys handed to recipients
- 0
- Median proxy latency added
- <10ms
- Audited per credential
- Every call
- Revoke on any credential
- 1-click
Verified compatibility with the APIs your team already uses.
Plus any REST API that uses Bearer, Basic, header-based, query-string, or OAuth 2.0 client_credentials auth — we add named vendors every week.
Three steps. No SDK. Plain HTTP.
Whoever needs to call the API — your engineers, an AI agent, a service account — already knows how to call a REST API. RelayKey just puts a thin, audited access layer between them and your real key.
Add the master key once
Paste your real upstream API key. RelayKey encrypts it at rest with envelope encryption and never echoes it back in the dashboard.
Issue a scoped credential
Pick the methods, paths, and lifetime. RelayKey runs a safety review on the scope before issuing the token.
- methods: GET
- paths: /crm/v3/objects/contacts/*
- expires: in 24h
Calls go through the proxy
Your team or agent calls proxy.relaykey.ai with the delegated token. RelayKey enforces scope, swaps in your real key, forwards the call, and audits everything.
$ curl https://proxy.relaykey.ai/conn_xxx/contacts \
-H "Authorization: Bearer rk_proxy_..."Method and path allowlists, default-deny.
Every credential gets an explicit list of HTTP methods and glob path patterns. Anything outside that scope returns 403 from RelayKey before the upstream call is made — and shows up in the audit log. No more handing over keys with full account access.
{
"allowed_methods": ["GET"],
"allowed_paths": [
"/crm/v3/objects/contacts/*",
"/crm/v3/objects/companies/*"
],
"deny_query_params": ["associations"],
"ttl_seconds": 86400
}Every request, captured.
RelayKey logs the timestamp, credential, method, path, decision, and response code for every proxied request. Filter by credential, integration, or status. Export when you need it.
Email confirmation on every new IP.
The first IP a recipient calls from is auto-trusted on the spot — no setup friction. Every new IP after that returns 423 Locked until the recipient clicks a confirmation link in their inbox. A token leaked into a public repo or a stolen laptop on a different network fails the second check, even if the recipient never noticed it was gone.
RelayKey saw a request from a new IP for your Kate Mason key. The call was blocked until you confirm.
If this wasn't you, ignore this email — the request was blocked. Link expires in 24 hours.
Issue credentials from your own automations.
Give an AI agent or internal service a provisioner-scoped management key. It can mint short-lived delegated credentials within constraints you set, but it can never read or export the upstream key.
$ curl -X POST https://app.relaykey.ai/api/v1/delegated-credentials \ -H "Authorization: Bearer rk_mgmt_provisioner_..." \ -H "Content-Type: application/json" \ -d '{ "connection_id": "conn_a1b2c3", "name": "agent-run-2026-05-01", "allowed_methods": ["GET"], "allowed_paths": ["/crm/v3/objects/contacts/*"], "ttl_seconds": 900 }'
Protect your first key in under three minutes.
Sign up, add an integration, issue a scoped credential, hand the share link to your vendor. Free forever for one protected key.