Skip to content
All stories
AIAgent auth

Pellucid Labs gave its agents credentials that expire

Agents were running on a long-lived API key nobody could scope.

Illustrative example

Pellucid Labs is a composite example, not a named customer. The situation and the way it was solved are drawn from what teams actually bring to us; the company itself is invented. Real customer stories are published only with the customer’s permission and their own name on them.

minutes
token lifetime
per-agent
revocation
1
principal per credential

The situation

Every agent shared one credential with full access. There was no way to say what a run was authorized to do, or to revoke one agent without breaking the rest.

What they did

Each agent registers, receives a token bound to one principal and one scope set, and the token expires in minutes.

What changed

Every call is attributable to a person and an intent. Revoking one agent affects only that agent.

Add SSO, the easy way

Everything in this story is something the platform already does. Start with the quickstart and have a working sign-in this afternoon.

What’s your enterprise story?

Tell us what the checklist is costing your team and we will give you a straight answer on fit.