# Sesame ## Docs - [Sesame: Zero-Trust Credential Broker for AI Agents](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/introduction.md): Sesame brokers API calls for AI agents so credentials are injected server-side — secrets never reach agent prompts, memory, or logs. - [Quickstart: Install Sesame and Make Your First Request](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/quickstart.md): Install the Sesame CLI, register your device, and proxy your first authenticated API request — credentials stay server-side the whole time. - [Inside Sesame: Zero-Trust Credential Broker Architecture](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/how-it-works.md): Learn how Sesame uses Ed25519 cryptographic identity and server-side credential injection to keep your API secrets out of agent reach. - [Onboard an Existing Agent to Run Keyless Behind Sesame](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/agents/transparent-egress.md): Wrap an existing agent under sesame launch, broker its egress hosts, verify it's protected, and strip the local credential so keys live only in Sesame. - [sesame login — Register a Device with Sesame Broker](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/login.md): sesame login registers your device by generating an Ed25519 keypair and opening a one-click claim URL. Use --new to register additional agents. - [sesame request — Proxy an Authenticated HTTP Request](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/request.md): sesame request proxies HTTP calls through the Sesame broker, injecting credentials server-side. Supports -H headers, -d body data, and --raw output. - [sesame status — View Device Fingerprint and Tokens](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/status.md): sesame status displays your device fingerprint, registered agents, and current JWT state. Use it to verify your device is registered and tokens are valid. - [sesame hostnames — Show All Configured API Hostnames](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/hostnames.md): sesame hostnames lists every API hostname that has a secret configured in your Sesame vault. Use it to confirm a provider is set up before making requests. - [sesame launch — Run an Agent Transparently Behind Sesame](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/launch.md): sesame launch routes an agent's egress through the local edge proxy to the broker. Wrap a container entrypoint, systemd unit, or foreground command — no code changes. - [sesame onboard — Detect, Verify, and Go Keyless](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/onboard.md): sesame onboard detect fingerprints an agent's deployment and egress, verify gates on whether it's protected, and neutralize swaps the local credential for a dummy. - [sesame proxyd — Manage the Local Edge Proxy](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/cli/proxyd.md): sesame proxyd reload sends SIGHUP to sesame-proxyd so a just-added secret's host is brokered immediately, without waiting for the ~60s host cache to expire. - [Sesame Agent Skills: Teach Your AI to Use the Broker](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/skills/overview.md): Sesame skills are drop-in agent configurations that route authenticated API calls through the broker automatically — no API keys in agent context. - [Install Sesame Agent Skills for Claude, Cursor, and More](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/skills/install.md): Install the Sesame skill to auto-detect your agent platform and configure it to route API calls through the broker instead of exposing credentials. - [Deploy the Sesame Broker in Your Own AWS Infrastructure](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/skills/self-host.md): Run the Sesame broker inside your own AWS VPC with your own Secrets Manager. One CLI command provisions VPC, database, and secrets infrastructure. - [Zero-Trust Architecture: How Sesame Protects Your Secrets](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/security/zero-trust.md): Sesame's zero-trust model keeps credentials out of agent reach by injecting secrets at the broker level — never in prompts, env vars, or tool arguments. - [Human Approval Flow for First-Time Agent API Requests](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/security/approval-flow.md): Sesame requires your approval the first time an agent accesses any new hostname. Approve or deny via the Sesame app, the Sesame dashboard, or Telegram in real time. - [Audit Logs: Complete Visibility into Agent API Requests](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/security/audit-logs.md): Sesame logs every proxied request, approval, and revocation event with timestamps and HTTP metadata — credential values are never included in logs. - [Revoke Agent Access Instantly — No Credential Rotation](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/security/revocation.md): Sesame lets you revoke an agent, a single approval, or all access in one click — immediately stopping all brokered requests without rotating your API keys. - [BYO or use 70+ Supported API Services](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/integrations/providers.md): Sesame has 70+ pre-built provider integrations. Add your API key in the dashboard and the broker automatically injects it for matching requests. - [MCP Server Integration: Zero-Trust Tool Access via Sesame](https://sesame-3de8950d-docs-transparent-onboarding.mintlify.site/integrations/mcp.md): Connect any MCP server through Sesame so your agent gets the tools without the tokens. Supports Linear, Atlassian, Sentry, and custom MCP servers.