KeyContain gives each AI agent its own API key, with fine-grained permissions for each service it can use. The product appeared on Show HN on 7 November 2026. You can read the launch thread at https://news.ycombinator.com/item?id=50407706.
What it is
AI agents need API keys to do useful work, but a single shared key with broad access is a risk: one careless or compromised agent can read, change or delete far more than it should. KeyContain solves this by issuing a separate key for each agent, with permissions set per service, covering Gmail, QuickBooks, GitHub, Cloudflare and almost any API.
Each permission has three rule levels. “Allowed” means the request goes straight through. “Ask me” means the request waits for the user’s approval, for up to 24 hours, with notification in the app or browser. The third level is refused, so the request never runs.
The official site gives concrete examples of how this works in practice. An agent may push only to agent-prefixed branches, while merges wait for approval. DNS changes wait for approval. QuickBooks invoices can be read, but new invoices wait for approval. The rules are specific enough to let an agent work on its own within safe limits, while keeping risky actions in human hands.
Key features
- A separate API key for each AI agent, with fine-grained permissions per service.
- Three rule levels: Allowed, Ask me, or refused.
- Approval requests that wait up to 24 hours, with notification in the app or browser.
- Support for Gmail, QuickBooks, GitHub, Cloudflare and almost any API.
- Service keys stored encrypted, with the decryption key not stored.
- Keys never appear in logs, and a key is unlocked only briefly in memory when used.
Who it is for
KeyContain fits anyone who lets AI agents act on real accounts and wants limits that hold even when the agent is unsupervised. It is useful for developers who give agents access to code repositories, for finance workflows where reading is safe but creating invoices is not, and for teams running agents against production services such as DNS.
It also fits users who want the convenience of agent automation without handing over a master key that can do everything.
Pricing
The Free plan costs $0 and includes 10 requests per minute and 100 MB traffic per month, shared across unlimited keys and services. Extra capacity is sold as capacity units at $0.50 per unit per month, where 1 unit equals 50 requests per minute and 1 GB traffic per month. The official site lists 4 units at $2.00 and 20 units at $10.00.
Sources and verification: Information in this article is based on the official website (https://keycontain.com/) and the launch announcement, checked on 8 November 2026. Prices may change; see the official website for current pricing.
Image: KeyContain (official brand mark)
