The list. Keycard made the 2026–2027 Fortune Cyber 60 in the early-stage group. Fortune’s profile lists it as founded in 2024, headquartered in Wilmington, Delaware, with 35 employees and CEO Ian Livingstone. Fortune reports $38 million in funding. Keycard’s own launch release in October 2025 breaks that into an $8 million seed co-led by Andreessen Horowitz and boldstart ventures and a $30 million Series A led by Acrew Capital. Valuation and revenue are Undisclosed. Lightspeed, which helps run the Cyber 60, is not listed as an investor.
Who built it. Livingstone and co-founder Matthew Creager ran platform engineering and developer experience at Snyk while its revenue grew from $30 million to $300 million, per Keycard. Co-founder Jared Hanson was chief architect at Auth0 and wrote Passport.js, one of the most used login libraries for Node.js. Angels include Auth0 co-founder Matias Woloski and former Okta chief product architect Karl McGuinness. This is a developer-tools team that has already sold identity once.
The problem, in plain words. An AI agent that books travel, edits code or queries a database needs credentials. Today it usually gets a static API key or a long-lived token with broad access, stored on disk, shared across tasks, and impossible to trace back to the person who asked. If the agent is tricked by a malicious prompt, it can do anything that key allows. Traditional identity tools answer “who are you?” once, at login. Agents need an answer to “what are you allowed to do right now, for whom?” on every single action.
The unique part: a fresh key for every task, narrowed at every hop. Keycard replaces static secrets with short-lived tokens that are tied to the agent’s proven identity, the user it acts for and the specific task. When one agent hands work to another, or calls an outside service, Keycard uses a standard called OAuth 2.0 Token Exchange to issue a new credential that can only be narrower than the one before it. Keycard says credentials live in memory, never touch disk, and expire when the session ends, and that one policy change revokes access across every affected agent. For coding agents, its keycard run command plugs into the hook and tool-approval systems of Claude Code and Cursor, so each tool call is checked before it runs. A partnership with Smallstep adds hardware-backed device proof: no verified machine, no credential. Andreessen Horowitz, an investor, says Keycard shipped the first production implementation of OAuth 2.1 Client ID Metadata Documents, a new way for agents to identify themselves without pre-registration. That is an investor’s claim, but the standards work is real and public.
Why it’s winning now. Agents moved from demos into production this year, and the protocol layer, MCP for tools and A2A for agent-to-agent calls, finally gave identity a place to plug in. Keycard shipped in sequence: coding agents in March, multi-agent apps in May, and an acquisition of Runebook to make MCP servers production-ready. It says Chime runs it in production. That is a company claim. Building on open standards rather than a proprietary gateway is the smart move. It means Keycard can sit across OpenAI, Anthropic and Microsoft agents instead of betting on one.
The risk: identity is a platform game. Okta, Microsoft Entra and CyberArk all see agent identity as theirs to lose, and they already own the human directory Keycard has to federate with. Another early-stage Cyber 60 name, P0 Security, pitches runtime access control for humans and agents alike. A $38 million company has to win developers before the incumbents bundle a good-enough version into a license customers already pay for.
Our read. Standing privileges, access that exists whether or not anyone is using it, are how most cloud breaches spread. Agents multiply them by the thousand. If task-scoped credentials become the default, the agent identity market looks less like a new product category and more like the next version of OAuth. Whoever ships the reference implementation developers copy wins it. Keycard is trying to be that.
For practitioners. Count the API keys your agents use today and how many of them could delete production data. That number is your agent blast radius, and it is the case for funding this work.
How are your AI agents getting credentials today: shared API keys, service accounts, or something scoped to the task?