Your agents shouldn't hold raw API keys.
KeyForge gives autonomous agents virtual keys instead of raw provider secrets, with hard spend caps, 429-resilient key pools, and an HMAC audit chain that proves exactly what happened while you weren't watching.
from openai import OpenAI
# One config change. Every model. Zero raw keys.
client = OpenAI(
base_url="https://api.metis.gold/api/gateway/v1",
api_key="vk_agent_adcopy_prod_7f3a" # virtual key, not sk_
)
result = client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": prompt}]
)
# Spend-capped · Rate-limit resilient · HMAC-loggedFour pillars of unattended safety
Each pillar removes a specific failure mode that makes autonomous systems dangerous to leave running.
Virtual Keys, Not Raw Secrets
Hand your agent a capped, revocable vk_ token, not your OpenAI org key. If the agent is compromised, revoke instantly. Other agents keep running.
Hard Spend Caps Per Key
Set a dollar ceiling on every virtual key at the gateway layer. A runaway loop in your ad-copy generator can never exceed the cap you set, no surprise bills.
429-Resilient Key Pools
On a provider rate limit, KeyForge auto-rotates to the next key in your pool, same provider, same model. Your pipeline self-heals instead of stalling.
HMAC Tamper-Evident Audit Chain
Every request is hash-chained with HMAC-SHA256. Tamper with one record and every hash after it breaks, mathematically provable compliance.
What goes wrong without a gateway
| Capability | KeyForge | Raw API Keys |
|---|---|---|
| Virtual key isolation | ||
| Per-key spend caps | ||
| Auto-rotation on 429s | ||
| HMAC tamper-evident logs | ||
| Model allow-listing per key | ||
| Instant key revocation | ||
| Zero raw key exposure to agents |
Built for systems that run while you sleep
Autonomous Ad-Copy Generation
Agents generating hundreds of ad variants 24/7. Spend caps prevent runaway costs. Audit chains prove what copy was generated and when.
Audience Segmentation & Analysis
LLM-powered audience clustering running on schedule. Model allow-lists constrain agents to approved models at the infrastructure layer.
Multi-Agent Orchestration
Planner, writer, and reviewer agents each get scoped virtual keys. One agent's compromise never cascades to the others.
Compliance-Heavy Environments
Finance, healthcare, and regulated industries need provable records. The HMAC chain is your audit trail, exportable, verifiable, tamper-evident.
One base URL. Every model.
GPT-4o, Claude 3.5 Sonnet, Gemini 2.0 Flash, Groq, OpenRouter , all behind a single OpenAI-compatible endpoint. Swap models by changing a string, not your agent code.
Stop handing agents your raw API keys.
Free tier includes 1,000 requests/month, 3 virtual keys, and 7-day audit retention. No credit card required.