Fort Card · Hosted

Your agent asks. You approve.
Your keys stay in the vault.

Fort Card is a vault for your API keys. Your AI agents work with a card instead of the key itself — when an agent needs to call an API, it requests a card scoped to that service and capped to a number of charges. The request lands on your phone; you approve it with a tap. The vault makes the call on the card's behalf and hands back the result, so the agent gets its work done while the key stays sealed inside. Hosted means we run all of that for you — and the lockbox your key seals in sits on your own Cloudflare, so only ciphertext ever reaches us.

Get started — $8/mo → Or self-host free (MIT) →

What it does

  • The agent works with a card, not the key. On a charge, the vault injects the real key on the server, makes the call, and hands back only the response — the key stays inside the vault.
  • A card, not a key. Scoped to specific hosts, capped to a set number of charges, and freezable. It works only on the services you allowed, only up to the cap you set, and a freeze stops it on the spot.
  • Connect an MCP agent by URL. Claude Code, Codex, other MCP clients connect to your wallet — and you approve the connection with your GitHub + passkey instead of pasting a key.
  • Agents ask; you grant. An agent can see its cards, charge one you've approved, or request a new one — issuing, approving, and recharging stay with you.
  • Capped or unlimited — your call. Your agent asks for a card with a charge limit, or for an unlimited one for a standing job. You approve the shape you want; how it gets used after that is on you.
  • A new card lands on your phone. When an agent requests one, it arrives frozen and pushes you a notification — and it stays frozen until you approve it.
  • One-tap freeze. Something looks off? Freeze a card on the spot.
  • It's all on the statement. Requests, charges, declines, freezes, approvals, revocations — appended to an audit ledger you can read. It records the act, not the key.
  • Your own space. Walled off behind your GitHub identity, separate from everyone else's.

Hosted isn't self-hosting — here's the split

Self-hosting means forking the code and running the whole thing yourself. Hosted is different: we run the brain — the wallet, the approvals, the audit log, the updates, all of it — and you keep one small lockbox: a last-mile worker on your own Cloudflare, where your key actually seals. Only ciphertext ever reaches us. That one worker is the whole reason your key sealing on your side is a fact you can check, not a promise you have to trust.

Setup happens once, and there's nothing to generate: deploy the lockbox (one click to Cloudflare), paste its URL into the wallet, tap approve. We claim the link for you — no keys to issue, no tokens to copy. Your agent can even do the wiring; you just approve.

You're not paying to do it yourself — you're paying us to run the hard part. The lockbox is just what keeps us honest.

Hosted, or run your own — your call

Hosted

$8 / mo · per agent

  • We run the wallet, approvals, audit, updates.
  • Your key seals in your own Cloudflare lockbox.
  • One-time setup: deploy, paste URL, approve.
  • $8/mo per agent · cancel anytime.
Get started →

Self-host

Free · MIT, your infra

  • Read every line. Run it yourself.
  • The key decrypts on your own box, on hardware you control.
  • Open source — audit it.
  • You run it; nobody's in the loop you didn't put there.
Get the code →

Why pay me $8 a month?

Fair question — the code's open, you could fork it for free. Here's the honest line: self-host and you run everything. Pay the $8 and I run everything — the wallet, the approvals, the audit, the upkeep — while your key still seals in a lockbox only you control. You're buying your way out of the ops, not out of the sovereignty.

This is built by one person, for people like me — indie devs handing API keys to agents and rightly uneasy about it. It's priced to stay small and honest, not to chase a valuation. Business is welcome to pay or self-host, but it doesn't get to steer the roadmap. Ask for a compliance feature and the answer is simple: the code's open — host it yourself. That's the deal, and it's not changing.

Want to run the brain yourself too — not just hold the key? That's self-host, and it's free.

Currently available in the United States only · Terms, Privacy & Eligibility →