Stop Giving Your AI Agents API Keys - Kim Maida, Keycard & Mason Egger, Temporal

Kim Maida of Keycard and Mason Egger of Temporal show how to build AI agents that are both secure and reliable. Kim replaces shared API keys with OAuth token exchange, so every tool call gets a short-lived token scoped to that one call and tied to both the agent's identity and the user it's acting for, building it live on an expense-approval agent with a full audit trail of who filed and approved what. Mason then uses Temporal's durable execution to kill an agent mid-task and bring it back exactly where it left off, without re-running LLM calls or storing credentials in its history. Chapters: 0:00 Intro 1:17 The problem with giving agents API keys 1:59 Token exchange, explained 3:10 Following a prompt through the agent loop 5:41 A separate token for every tool call 8:49 Workshop setup: an expense desk agent 10:28 Before: everyone shares API keys 12:51 Giving the agent its own identity 21:47 Wiring token exchange into the code 26:05 The agent acting as itself 28:00 Reading the audit log 31:22 Adding human users without impersonation 34:01 Approval limits and who approved what 38:09 Tracing the delegation chain 41:26 Temporal: durable execution for agents 46:01 Killing a worker mid-run, and recovering 48:07 Why durability matters for agents 49:28 Keeping secrets out of the event history Kim Maida https://keycard.ai Mason Egger https://temporal.io Join us in SF for the second annual AIE CODE summit: https://aie.codes our last flagship summit of 2026. Applications live now!