KeyLynk
Zero-knowledge security for autonomous agents

Your secrets, scoped. Zero-knowledge.

Stop pasting raw API keys into n8n, Make, and your AI agents. Provision strictly scoped credentials instead — without ever exposing them to server-side decryption.

Create your free vaultSee pricing
POST /api/v1/provision
curl -X POST https://api.key-lynk.com/v1/provision \
-H "Authorization: Bearer klt_live_9a8b7c6..." \
-H "Content-Type: application/json" \
-d '{"agent": "n8n-workflow-42", "scopes": ["read:openai_key"]}'

Built for production workflows

n8nMake.comZapierOpenAI AgentsClaudeLangChain

Secure integration in three steps

No complex key management. Just create a vault, add your secrets, and issue tokens exactly where they're needed.

1. Create your vault

Your master password derives a local key. The vault is encrypted client-side before it ever hits our servers.

2. Add credentials

Store API keys, database URLs, and passwords. Everything is secured with AES-256-GCM encryption.

3. Issue a scoped token

Generate a token specifically for one agent or workflow. Limit access to only the secrets it needs.

Enterprise-grade security without the overhead

Zero-knowledge encryption

We literally cannot read your secrets. Decryption keys are derived on your device and never transmitted.

Scoped agent tokens

Follow the principle of least privilege. Issue tokens that can only read specific keys, not the whole vault.

Revoke without rotating

Compromised agent? Instantly revoke its token without needing to rotate the underlying API keys in your vault.

n8n Provisioner-ready

Push secrets directly into n8n via its REST API. Eliminate the need for the expensive Enterprise plan.

Emergency recovery kit

Download an encrypted offline backup containing your Account Key and Salt. Recover your data even if we disappear.

Audit log (Builder)

Track exactly which agent accessed which secret and when. Maintain full visibility over your automated infrastructure.

Cryptographically sound by design.

KeyLynk uses an Account Key model. Your master password derives a vault key locally using PBKDF2 with 100,000 iterations.

  • AES-256-GCM authenticated encryption
  • PBKDF2HMAC (100k iterations, SHA-256)
  • Client-side key derivation
  • SHA-256 token hashing for database storage
crypto.tsTypeScript
const deriveKey = async (password: string, salt: Uint8Array) => {
  const baseKey = await crypto.subtle.importKey(
    'raw', new TextEncoder().encode(password),
    'PBKDF2', false, ['deriveKey']
  );

  return crypto.subtle.deriveKey(
    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
    baseKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']
  );
};
Why scoped tokens matter

Over-scoped agents are already causing incidents

A long-lived, unscoped API key sitting inside an n8n workflow or an agent's context window is a liability, not a convenience.

53%

of organizations report AI agents have already exceeded their intended permissions, per a 2026 Cloud Security Alliance / Zenity survey of 445 security professionals. Only 8% said their agents never exceed scope.

Cloud Security Alliance, April 2026 →
Sev-1

In March 2026, an internal Meta AI agent posted unapproved, incorrect guidance to an engineering forum. An employee acted on it, exposing company and user data to unauthorized staff for two hours.

TechCrunch, March 2026 →

A scoped token can only do what you let it. If it's compromised or misbehaves, you revoke it — the rest of your vault stays untouched.

Simple pricing for builders

Starter

Free

For personal projects and testing.

  • 25 Secrets
  • 1 Agent Token
  • Zero-knowledge encryption
Start for free
POPULAR

Builder

$10/mo

For production automation workflows.

  • Unlimited Secrets
  • Unlimited Agent Tokens
  • Full Audit Logs
Start 14-day trial
See full pricing and feature comparison

Ready to secure your workflows?

Every long-lived key you hand an agent is a liability waiting to happen. Scope it before it becomes one.

Create your free vault