One Credential
Delete your agents' API keys.
Give each agent a key that's created in hardware and tied to the person it works for. A service checks the agent's signature instead of a secret, so it has nothing to store and nothing to leak.
What's wrong with an API key
An API key is a string, and anyone who copies it can use it. It works from anywhere until someone rotates it, and most never get rotated.
Keys spread into config files, logs, tickets and chat. Every new agent adds a few more, and when one leaks, nobody can say which person it belonged to.
The swap
With Zetna™, every agent gets its own key, created in hardware: the TPM 2.0 chip on a Linux server, or the Secure Enclave on a Mac. The key can't be copied off the machine, and it signs every request.
Agents get their credentials from their person's, so every key traces back to a named person. A service accepts an agent because its request is signed by a key that leads back to someone who answers for it.
The service checks the signature. It has nothing to store and nothing to leak, and there's no key to paste into a config or rotate.
One revoke cuts off the person and every agent they issued, everywhere the credential is accepted, at the next request.
A service can insist on a hardware key and refuse an agent whose key is in software. Every receipt of an agent's act records where its key lives.
The same credential for people
People sign in and approve with one touch on a hardware security key. There's no password to steal, reuse or reset.
Each service sees you under a private name of its own, so two services can't compare notes and match you.
Phishing gets nothing: the key only answers to the real site, so a look-alike site is refused.
What others already do, and where we differ
Agent identity products already register agents, tie each one to a human owner and approve each tool call. That's real work, and I won't pretend otherwise.
Where we differ is the credential. Every request is signed by a key held in hardware, rather than carried by a token anyone can copy. The evidence is a signed receipt anyone can check without the vendor, and that includes us. And it's one credential that works across services and across organisations.
It gets more useful as it spreads
Every service that accepts it makes it worth more to the next. A person or agent enrolled once is ready for the next service that accepts it, and that service gets everyone who already has one.
Accept Zetna instead of an API key
Here's what your service does with each request.
- Your service receives the agent's signed request.
- It checks the signature and the chain back to a named person.
- It acts, with nothing stored and nothing to rotate.
Operators: issue One Credential to your customers
If you run a network, a cloud or a data centre, you can issue One Credential to your customers' staff and their agents from your own server, under your own brand.
Start with the four-week pilot. Write to me at hello@zetna.ai and tell me which customers you'd start with.