Docs
Store your API keys in Botpasses, connect an agent, and approve its access. Botpasses makes the API calls with your keys and returns responses with secrets removed. Follow the quickstart to connect your first agent.
Start
- StartCreate a Botpasses account, enroll an authenticator, connect an agent, then ask it to set up a provider or store a credential yourself. About five minutes end to end.
- InstallUse the hosted service at botpasses.com, or run the CLI from the repository until the npm package is published. Requirements and first commands.
- Copy-paste promptsPaste-ready prompts so an agent sets up Botpasses: hosted MCP, a local laptop vault, or a self-hosted plane. Type secrets on Botpasses, never in chat.
How to
- Store a credentialStore an API key or OAuth client secret in the Botpasses console, choose how it is sent, and restrict the hosts that may receive it.
- Approve a requestHow an agent asks to use a credential, the four approval policies, and the three ways to approve. Inbox, 8-digit code, or email link.
- Guided setupConnect Botpasses MCP once, then ask an agent to set up Spotify or another API. You type the secret on botpasses.com, never in chat.
- Revoke accessStop an agent, a single approval, or a signed-in session from the console Access panel, and read the activity log that never contains values.
- Use an OAuth client secretStore an OAuth app's client secret so Botpasses mints app tokens for you, and connect a user account when an API needs a user token. Spotify walkthrough.
Connect an agent
- Connect ClaudeAdd Botpasses to Claude on the web or Claude Desktop as a custom connector, sign in on botpasses.com, and let Claude call APIs without seeing the keys.
- Connect Claude CodeRegister Botpasses in Claude Code with one claude mcp add command, sign in from the /mcp menu, and call APIs from the terminal without keys in your shell.
- Connect CursorAdd Botpasses to Cursor with a two-line mcp.json entry for the remote server, or run the stdio server against a local vault. OAuth sign-in on botpasses.com.
- Connect ChatGPTAdd Botpasses to ChatGPT as a connector using the remote MCP URL and OAuth. botpasses.com handles registration, sign-in, and consent.
- Connect GrokConnect Grok Bot with the /mcp URL and complete Authorize in the browser, or put a one-time model token on the connector. Grok Build uses grok mcp add.
Reference
- MCP toolsThe six hosted MCP tools, their arguments and results, the JSON-RPC methods, auth, and the next steering field. There is no get_secret.
- HTTP APIEvery hosted route on botpasses.com. Operator JSON under /api, model routes, trusted resolve, OAuth endpoints, discovery, and the local vault serve API.
- CLIEvery vault command. Local SQLite vault, grant and run with env injection, the loopback server on port 8788, and hosted login plus MCP over stdio.
- Rate limits and size capsThe request limits, lifetimes, and size caps enforced by botpasses.com, and what the 429 means for an agent that hits one.
Explanation
Help
- TroubleshootingFixes for host_mismatch, mfa_required, a connect card that keeps appearing, 409, need_item, 429, hosted:dev on port 8888, SQLITE_BUSY, and a missing laptop OTP.
- FAQWhat Botpasses is, how it differs from a password manager, .env keys, and Composio, plus prompt injection, logs, revoke, staging, and whether staff can read keys.
- Self-hostingRun the hosted process on any Postgres 16 and an https origin you control. Laptop hosted:dev uses sqlite. Fly, Neon, Cloudflare, and AWS KMS are the reference stack. Required secrets table.
- Security disclosureHow to report a vulnerability in Botpasses. Email [email protected], what to include, what to expect, and the machine-readable security.txt.