Creance
Grant · Act · Record · Expire

Fly your agents. Keep the keys.

The stationmaster's register for agents that ship.

Creance is a small keeper that runs on your own machine. It holds your long-lived credentials, sealed. When an agent needs to ship, it asks the keeper. The keeper mints a narrow, short-lived key and performs the act itself, through one gate. Every step lands in a ledger you can read.

$ npx creance up

identity only · sign-in asks for no access to your repos

The local tool is free and needs no account · it reaches npm at launch, with the source · read the docs

No. Time Mount Entry Remarks
No.01 Time08:14:02 Mountacme/keeper Entrykey minted · github write Remarksttl 9m
No.02 Time08:14:05 Mountacme/keeper Entrycreate_release · v0.1.0 Remarksheld for you · one gate
No.03 Time08:14:11 Mountacme/keeper Entryreleased · v0.1.0 Remarks·
No.04 Time08:23:02 Mountacme/keeper Entrykey died on its own Remarksink still wet
4 lines · this specimen 1 held for you every line stamped & hash-chained chain k-0e7f · sealed
A specimen of the register. A grant is minted, an act is held for you, the release is recorded and the key expires. Each line is hash-chained to the one before it.
The loop

Four lines, and the register writes every one.

1Grant

The keeper mints a narrow, short-lived key when the agent needs to ship. The long-lived credential stays sealed on your machine.

2Act

Every action passes one gate, and the gate performs the act itself, so the credential stays inside the keeper. A sensitive act waits for your approval.

3Record

Every grant, act and expiry is written as a stamped, hash-chained line. The keeper reconciles the ledger against each platform's own audit log.

4Expire

The key expires on its own. You can also revoke everything at once, and the revoke completes on your machine even when a platform cannot be reached.

Tiers

The tool is whole at the first column.

Solo and Team add a relay that we host and run.

Local

Free, forever · no account

  • The whole tool, on your machine.
  • Your ledger and your kill switch stay local.
  • You can self-host the relay as well. All of it is Apache-2.0.

Solo

early access

  • One person, unlimited devices.
  • End-to-end encrypted sync. The relay holds only ciphertext.
  • One eye across every machine.
  • Drive-from-anywhere requests.

Team

early access

  • Everything in Solo, for many people.
  • Shared policy and multi-owner custody.
  • Offboarding that rotates the key.

Solo and Team prices are shown once you sign in.