Token Vault Documentation
Documentation for Token Vault — webhook-sovereign credential brokering, MCP proxy, OAuth 2.1 for MCP clients, agent grants, and ABAC policies for AI agents.
Token Vault is a webhook-sovereign credential broker for AI agents. Your credentials live on a webhook server you deploy and control; Token Vault brokers scoped, policy-gated, audited access to them — and never holds, sees, or can decrypt a credential.
Start here
Quickstart → — deploy the reference webhook to Cloudflare Workers, bind it, and have an agent fetch its first credential. About ten minutes with a free Cloudflare account. No account yet? Sign up free with Google.
The Essentials
Quickstart
Zero to an agent fetching a real credential from your own vault — copy-paste steps.
What is Token Vault?
The two-plane architecture: why credentials never touch Token Vault, and what that buys you.
OAuth 2.1 for MCP Clients
Connect Claude, ChatGPT, or Cursor with a standard in-client OAuth flow — no pasted keys.
MCP Proxy
Your webhook injects real credentials server-side, so agents never hold a key at all.
Using Token Vault
Agents & Grants
Create agent identities with scoped, time-limited credential access — revocable instantly.
Token Management
Add tokens via OAuth or manually. Token types, TOTP, raw credentials, automatic refresh.
Access Policies
ABAC rules: time windows, IP allowlists, rate limits, usage caps, and manual approval.
tvault CLI
Command-line tool for managing tokens, agents, and vault operations.
Running Your Vault
Webhook-Sovereign Architecture
How the two-plane design keeps credentials on your infrastructure and out of Token Vault.
Reference Webhook (TypeScript)
Multi-runtime — Cloudflare Workers, Cloud Run, Deno. Clone and deploy.
Webhook Protocol
Implement your own webhook: HMAC-signed endpoints, tickets, and the full /v1/ reference.
API Reference
The agent credentials API: auth forms, the 307 contract, and the full error catalogue.