Docs

The agent never sees the key

User connects OAuth → broker stores encrypted tokens → agent calls POST /v1/tools/execute with a short-lived JWT → broker injects credentials server-side → results only.

Quickstart

Connections → Connect GitHub
Agents → confirm registry entry
Playground → run tool call
Approvals → Approve or Deny
Calls → verify audit row

TypeScript SDK

Package @broker/sdk-ts — server mints JWT with BrokerControlClient; agents call BrokerAgentClient.executeTool only. Never pass bk_* keys to agent runtimes.

import { BrokerControlClient, BrokerAgentClient } from "@broker/sdk-ts";

const { access_token } = await new BrokerControlClient({
  baseUrl: "https://api.callvault.dev",
  controlApiKey: process.env.BROKER_CONTROL_API_KEY,
}).mintBrokerToken({ agent_app_id: AGENT_ID, env: "test" });

await new BrokerAgentClient({ baseUrl: "https://api.callvault.dev", accessToken: access_token })
  .executeTool({ tool_name: "github.list_issues", connected_account_id: CONNECTION_ID, arguments: {} });

Full quickstart: packages/sdk-ts/README.md in the repo.

OpenAPI

https://api.callvault.dev/openapi.json