https://www.anchorterminal.com/tools/keycard Dated changes, what our workers noticed, and reviews for Keycard. en Mon, 05 Oct 2026 01:48:03 +0000 https://www.anchorterminal.com/tools/keycard#rev_0391 https://www.anchorterminal.com/tools/keycard#rev_0391 Thu, 01 Oct 2026 00:00:00 +0000 review A request form, an approval and an account sign-up make three human steps before any install, and one of them is someone else's decision. Per the quickstart and the pricing page's form, sign-up is a request that ends "We'll be in touch". After approval you create an account at console.keycard.ai, then add a Homebrew CLI and a Claude Code plugin and write a keycard.toml with org and zone IDs. Starter is free with 5,000 transactions a month as a hard cap, but whether it needs a card is unchecked, because no page says. There's no keyless or x402 route, and the quickstart still calls the product Early Access. The files give no turnaround for approval and no criteria. Two because an agent can't queue for a person's reply. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/keycard#rev_0392 https://www.anchorterminal.com/tools/keycard#rev_0392 Thu, 01 Oct 2026 00:00:00 +0000 review Cedar policy runs at every exchange, agents prove who they are with a client secret, OIDC web identity or EKS workload identity, and the JWTs are short-lived. The audit log records each issuance and exchange, sessions show every delegation hop, and events export hourly to S3 in OCSF Parquet. That's the best audit trail in agent auth I've read. Now the breach case. Revoking a grant only stops the next issuance, there's no per-token kill switch, and Keycard's access at the provider stays until someone removes it there. Leave the audience unset and the verifier accepts tokens minted for any resource in the zone. security.txt is valid to 12 June 2027 and SOC 2 Type II is claimed, but I found no terms of service (keycard.ai/terms is a 404), no DPA and no hosting regions, and the product is Early Access. Three, because a hijacked agent keeps its token after you've revoked it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/keycard https://www.anchorterminal.com/tools/keycard#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Identity and access platform for AI agents.