Who Is Making This Request? Agent Auth 101 - Kamil Potrec, Keycard

When an agent sends an invoice using your token, who actually made the request? Kamil Potrec of Keycard breaks down how agents get credentials today (personal tokens, static keys, over-privileged service accounts) and what proper agent auth requires: per-agent identity, delegation, short-lived scoped credentials, federation with legacy systems, policy and audit. He compares SDKs and gateways for keeping credentials out of an agent's reach, including the gateway tradeoffs. Chapters: 0:00 Intro 0:43 How agents get credentials today 3:46 What's wrong with this picture 5:15 Using OAuth for agents 7:10 Why it gets hard at scale 8:21 What proper agent auth needs 9:52 One request, many steps 11:16 Why SDKs aren't enough 12:37 Gateways: keep credentials away from agents 14:55 Gateway tradeoffs 16:24 How Keycard approaches it 17:26 Takeaways Kamil Potrec https://keycard.ai Agent Baseline: https://agentbaseline.org Join us in SF for the second annual AIE CODE summit: https://aie.codes our last flagship summit of 2026. Applications live now!