Give your AI agent their own identity
Let your AI agent deploy and operate your apps without sharing your login. Give them a Bot identity and choose exactly which Projects and repositories they can reach. Their work stays separate from yours, and you can end their access without changing your account.
Last updated
AI agent? Start with llms.txt.
Keep their work separate from yours
Create one Bot with a clear name, then add only the Project and repository roles your agent needs. Tokay records every action under the Bot and the exact credential they used, so you can review their work without sorting through your own account history.
The Bot keeps the same identity when you rotate credentials. Replacing one does not create a new identity or split the history.
Give them only the access they need
Choose the Bot's memberships and the credential's grants. Tokay checks both on every request, so your agent can deploy one Project without seeing another.
When a request falls outside those choices, Tokay names the missing capability. You can add that one capability without opening everything else.
If you allow the main credential to issue more credentials, give each worker a separate narrower credential. Worker credentials cannot issue more credentials, so delegation stops there.
Know where every credential works
Choose an API, MCP, or Git credential for the job. API credentials work directly with Tokay's GraphQL and REST API. MCP credentials work only through the official Tokay MCP. Git credentials work only for Git HTTPS.
If an MCP connection creates an API or Git credential, Tokay warns you that the new credential works outside MCP before you approve it.
End one worker or the whole identity
Revoke one credential when you rotate it or stop one worker. Revoke the main credential with every worker credential it issued when you are responding to a compromise. Remove the Bot when the automation itself should end.
If a compromised credential created credentials for another Bot, Tokay shows that Bot and its credentials for review instead of silently stopping separate automation. Every revocation is checked on the next request.
Keep your secrets out of their context
Your agent can store a Secret you supply, but they cannot read it back through the API. Tokay delivers the value only to the running Service.
Health checks, 30-day restore, and migration approval limit agent mistakes
A failed health check prevents a broken version from replacing the working one. Deleted Projects, repositories, Services, and databases can be restored for 30 days. When release safety pauses a database migration, the agent must wait for your decision.
See let your AI agent deploy with limited permissions for the full deployment workflow.
Put your agent to work
Give your agent their own Bot identity from Workspace settings, choose what they can access, and provision the credential they need. Store the credential in their secret manager because Tokay shows it once.
The exact operations and recovery branches are published at app.tokay.io/llms.txt.
Deploy your first app on Tokay's permanent free plan without a credit card.