Tokening 0.1 Gives AI Agents Single-Use API Grants

An agent needs to fix the title of one blog post. To do that today it usually gets an account password, and that password can also delete the post, publish drafts and change the site’s settings. It works tomorrow too, and next month. Tokening is a small gateway that hands the agent something much narrower: a grant for this post, these fields, one use and a fifteen-minute deadline.

The agent sends its calls to Tokening with the grant’s secret. Tokening checks each call against the grant. If it fits, Tokening spends the use, adds the real credential from its encrypted vault and passes the call on. If it doesn’t fit, the call stops there and the agent gets a reason in plain words: “Grant is bound to id 2; call sent id 3.”

The demo shows the whole thing on a throwaway WordPress. The agent edits post 2 and WordPress accepts it. It tries the same edit again and is refused, because the only use is gone. It tries post 3, then tries to delete post 2. Both refused. Then two calls hit a fresh one-use grant at the same moment and exactly one wins. Afterwards the operator reads WordPress directly to confirm what actually changed.

What’s in 0.1

One Go binary with a SQLite file, for Linux, macOS and Windows. It forwards MCP over HTTP and plain REST calls. You declare templates in a JSON policy, store real credentials in the vault, then issue, inspect and revoke grants from the command line. Every decision lands in an append-only log you can export. A read-only panel shows a grant and its decisions live.

Version 0.1.1 makes refusal reasons more specific and turns the demo into a step-by-step replay.

What it asks of you

A grant only helps if the agent has no other way in. Keep the real API key out of the agent’s environment and files, and keep Tokening’s admin port where the agent can’t reach it. A template also needs sensible limits. Tokening checks which post and which fields; it won’t tell you whether the new title is a good one.

Uses are spent before a call goes out. If the API then fails, the use is still gone, so a lost response can’t turn into a second write. Check the result and issue a fresh grant if you need another try.

Next

Stdio MCP servers, grant requests that wait for a person to approve them, and ready-made templates for GitHub, Stripe and Slack.

Download 0.1.1, follow the quick start or read how it works. It’s Apache 2.0.