Wire your agent to a real stack.

1. 01Sign up at stackstart.co.
2. 02Select a stack (Starter, SaaS, Agent Native) — or build your own.
3. 03Connect your provider accounts (OAuth for the OAuth-enabled ones, paste a token otherwise).
4. 04We provision the resources on your accounts — never ours.
5. 05Copy your master key. Shown once.
6. 06Paste it into your agent / editor / .env. Done.

Every other route on stack start is plumbing. This is the contract your agent actually calls. The bearer token is the master key shown once at provision time.

ss_ prefix, then base64url of 24 cryptographically random bytes. On reveal we display it in 4-char groups for easy verification:

• · Bcrypt-hashed at rest (cost 12). The raw key never touches disk.
• · Shown once at generation. After that, only the 8-char prefix (ss_4f9c) is visible.
• · Lost the key? Rotate it (see below). The underlying provider credentials stay put.

The resolve endpoint is rate-limited to 100 requests / hour / key. Every successful and rejected call is written to the audit log on your account — visible under Settings → Audit. Exceed the limit and the endpoint returns 429 Too Many Requests with a Retry-After header.

Resolve responses are meant to be cached in your process for the life of the run, not re-fetched per request — the limit is generous for that pattern and a tripwire for credential exfiltration.

Call POST /api/keys/{id}/rotate to mint a replacement. The old key starts returning 401 Unauthorizedthe moment the new one is issued — there's no overlap window. The underlying provider credentials (your Neon DB URL, your Clerk secret) do not change. Only the resolver token does.

Every stored provider credential — OAuth refresh tokens, API keys, service-role secrets — is encrypted with pgcrypto using a server-side master key that is never logged or exposed. You can revoke any connection from Settings → Connections; revocation is immediate and the next resolve call for that provider returns an error rather than stale credentials.

Clerk JWTs flow into Neon's JWKS, which means your DB rows enforce row-level security under the same user identity your agent authenticated with. Full threat model on the Security page.

↳ full catalog of 90 on the Services page