# Sesame

## Docs

- [Sesame: Zero-Trust Credential Broker for AI Agents](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/introduction.md): Sesame brokers API calls for AI agents so credentials are injected server-side — secrets never reach agent prompts, memory, or logs.
- [Quickstart: Install Sesame and Make Your First Request](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/quickstart.md): Install the Sesame CLI, register your device, and proxy your first authenticated API request — credentials stay server-side the whole time.
- [Inside Sesame: Zero-Trust Credential Broker Architecture](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/how-it-works.md): Learn how Sesame uses Ed25519 cryptographic identity and server-side credential injection to keep your API secrets out of agent reach.
- [sesame login — Register a Device with Sesame Broker](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/cli/login.md): sesame login registers your device by generating an Ed25519 keypair and opening a one-click claim URL. Use --new to register additional agents.
- [sesame request — Proxy an Authenticated HTTP Request](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/cli/request.md): sesame request proxies HTTP calls through the Sesame broker, injecting credentials server-side. Supports -H headers, -d body data, and --raw output.
- [sesame status — View Device Fingerprint and Tokens](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/cli/status.md): sesame status displays your device fingerprint, registered agents, and current JWT state. Use it to verify your device is registered and tokens are valid.
- [sesame hostnames — Show All Configured API Hostnames](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/cli/hostnames.md): sesame hostnames lists every API hostname that has a secret configured in your Sesame vault. Use it to confirm a provider is set up before making requests.
- [Sesame Agent Skills: Teach Your AI to Use the Broker](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/skills/overview.md): Sesame skills are drop-in agent configurations that route authenticated API calls through the broker automatically — no API keys in agent context.
- [Install Sesame Agent Skills for Claude, Cursor, and More](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/skills/install.md): Install the Sesame skill to auto-detect your agent platform and configure it to route API calls through the broker instead of exposing credentials.
- [Deploy the Sesame Broker in Your Own AWS Infrastructure](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/skills/self-host.md): Run the Sesame broker inside your own AWS VPC with your own Secrets Manager. One CLI command provisions VPC, database, and secrets infrastructure.
- [Transparent Egress: Run Any Agent With Zero Keys](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/agents/overview.md): Wrap any agent with `sesame launch` so every call to a brokered API is injected server-side. No code changes, no API keys in the agent — Sesame is the broker.
- [Connect OpenClaw to Sesame: A Keyless AI Agent](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/agents/openclaw.md): Run your OpenClaw gateway through Sesame so LLM and tool calls are injected server-side. OpenClaw holds only dummy placeholders — no real API keys.
- [Connect a Hostinger-Hosted OpenClaw to Sesame](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/agents/openclaw/hostinger.md): Onboard an OpenClaw instance deployed from Hostinger's managed Docker template — panel first, container second. Validated end-to-end on a fresh template container.
- [Zero-Trust Architecture: How Sesame Protects Your Secrets](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/security/zero-trust.md): Sesame's zero-trust model keeps credentials out of agent reach by injecting secrets at the broker level — never in prompts, env vars, or tool arguments.
- [Human Approval Flow for First-Time Agent API Requests](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/security/approval-flow.md): Sesame requires your approval the first time an agent accesses any new hostname. Approve or deny via the app, dashboard, or Telegram in real time.
- [Audit Logs: Complete Visibility into Agent API Requests](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/security/audit-logs.md): Sesame logs every proxied request, approval, and revocation event with timestamps and HTTP metadata — credential values are never included in logs.
- [Revoke Agent Access Instantly — No Credential Rotation](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/security/revocation.md): Sesame lets you revoke an agent, a single approval, or all access in one click — immediately stopping all brokered requests without rotating your API keys.
- [BYO or use 70+ Supported API Services](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/integrations/providers.md): Sesame has 70+ pre-built provider integrations. Add your API key in the dashboard and the broker automatically injects it for matching requests.
- [MCP Server Integration: Zero-Trust Tool Access via Sesame](https://sesame-3de8950d-docs-self-host-url-discover-or-ask.mintlify.site/integrations/mcp.md): Connect any MCP server through Sesame so your agent gets the tools without the tokens. Supports Linear, Atlassian, Sentry, and custom MCP servers.