Questions & answers
Short answers, with a link to the long one.
The basics
What problem does Permaura actually solve?
Agents increasingly need to do things, and the naive way to let them is to hand over an API key. From that moment the secret is in the model's context, its logs, and its blast radius. Permaura sits in between: the agent calls a capability, Permaura checks policy, injects the real secret on your gateway, makes the call, and returns only the result. See How Permaura works.
What is a "gateway"?
The program that holds your keys, enforces policy, and makes the actual calls. One self-contained binary. It can run on your machine, on your machine behind a public URL, or on Permaura's infrastructure: the same binary in three placements.
Do I have to install anything?
No, if you pick Let Permaura host it. Otherwise it's one command, or the desktop app for macOS, Windows or Linux. See Connect a gateway.
Which AI clients work with it?
Any client that speaks MCP: Claude, Claude Code, ChatGPT, Cursor, Codex, and others. Connect your AI client has the per-client detail.
Security
Can an agent ever read my API key?
Permaura never gives it one. Tools are named for what they do, and there is deliberately no capability that returns a secret. The gateway resolves the plaintext inside a single call, uses it, wipes it, and never hands it to the agent.
The way a key could still come back is in the upstream API's own response, so the gateway cleans each response before the agent sees it. It blanks fields whose names are known to carry secrets and, from gateway 1.3.44, replaces the credential it opened for that call if it is at least 8 bytes long, as is or in the common encodings an API echoes (JSON-escaped, base64, an HTTP Basic header, percent-encoded). A shorter credential, a key returned as hex, as a hash or in part, a value encoded twice, or a secret the call did not open can still get past that, so leave a capability switched off if it returns account details no agent needs. What Permaura protects has the detail.
What stops a prompt injection from doing damage?
Policy, not trust in the model. An agent can ask for anything; only your grants decide what runs, and Permaura denies by default. An injected "refund everything" instruction hits the same wall a legitimate request would, and the refusal is recorded. See How a request is decided.
Are my secrets really never sent to Permaura?
An agent's calls never go through permaura.com: with a local or tunneled gateway, an agent's call does not pass through it, and the key is stored sealed on your machine and nowhere else. Through a tunnel or address of your own, nothing Permaura runs is in the path. A managed permaura.app tunnel is the exception: the call passes through Cloudflare under Permaura's Cloudflare account, which terminates TLS for that hostname and can see or redirect the call, and run a second connector for the tunnel, as the threat model explains (the destination on your side is still written on your machine, and the gateway or the desktop app stops the connector if Cloudflare pushes it another configuration, as Remote access explains). The console and the Permaura app are different. When they manage a gateway they cannot reach directly, which means any gateway with remote access on or on another machine, permaura.com relays their requests to it, in memory and without logging them. That includes a credential you type into the console or the app, a key you rotate there, and a vault export or import with its passphrase. To keep a credential off permaura.com entirely, set it through the gateway's REST API on 127.0.0.1, from the gateway's own machine. The console on that machine with remote access off sends it straight to the gateway rather than through permaura.com, though the console's code still comes from permaura.com, as described further down this answer. To export the vault without permaura.com, use permaura vault export there or the desktop app's Export Data.
With hosted execution, a Permaura-run worker makes the call, so it necessarily decrypts the secret at that instant, which is why we say hosted is not zero-knowledge rather than pretending otherwise. The honesty rule is written down for exactly this reason.
The console is the other route to think about on a gateway you run yourself, because its code is served by permaura.com and reaches the gateway from your browser or, for a tunneled gateway, through permaura.com. From gateway 1.3.44, while no device is paired, the gateway refuses four requests that come from a web page, through permaura.com or from another machine: a vault export, an import that would replace or attach to a credential already there, a new connection that would take over a stored credential, and an edit that changes where an SSH connection's credential is sent or how it is presented. From gateway 1.3.46 it refuses them the same way after a device is paired if you have lowered the approval floor, since then nothing would hold them for the device. The refusal says to do it from the desktop app or the permaura CLI on the gateway's own machine, or to pair a device or raise the floor first. Otherwise, once a device is paired, an export waits for its signature. Until a device is paired, permaura.com's console code can still configure a self-run gateway and use its credentials through an agent it approves, without reading them.
Can Permaura see what my agents are doing?
Metadata about decisions, yes: that's what makes the console and audit views work. An agent's calls go directly between your gateway and the upstream API and don't pass through permaura.com when your gateway is local or tunneled. Through a tunnel or domain of your own, or with no tunnel at all, they don't pass through anything Permaura runs. Through a managed permaura.app tunnel they do pass through Cloudflare under Permaura's Cloudflare account, which terminates TLS for that hostname and can see or redirect them, and run a second connector for the tunnel, as the threat model explains.
What you open to review is different. Each approval record on your gateway keeps the arguments the agent sent and, once the call has run, its redacted result, and nothing prunes those records. When you open one in the Permaura app, or in the console for a tunneled or hosted gateway, it reaches you through permaura.com, which relays it from your gateway.
What if someone gets into my Permaura account?
On a gateway you run yourself, from gateway 1.3.44, they can't export your credentials from the console while no device is paired, or from gateway 1.3.46 while you have lowered the approval floor, and otherwise the export waits for your device (more above). On a hosted gateway with no device paired, an export from the console goes ahead without any device once whoever asks confirms it's you, and your password alone does that unless it changed in the last seven days, so pair one there too. Once you've paired a device they can't lower the approval bar with the session alone. On a local or tunneled gateway that change can only be made from the machine running it. On a hosted gateway it needs you to confirm it's you, and while you still have a working approval device that device has to sign the change too, which a stolen session and your password together still can't do. They could change grants, which is why every account holds a strong factor and every sign-in asks for a second factor.
Could someone with my account enroll their own approval device?
On a local or tunneled gateway, no: enrolling a signing key needs a command run on the machine your gateway runs on, which an account session doesn't get you.
On a hosted gateway there is no such machine, so the honest answer is narrower. Someone who can confirm they're you (a live session plus a passkey, your phone or your password, not the session alone) can enroll the first device on a gateway that has none. Signing in takes your password and a second factor, and an emailed code counts as that second factor unless your password was just reset, so someone holding both your password and your inbox can sign in and then confirm with the password alone; keep your email account as well protected as this one. Every device after that has to be confirmed by a device you already paired, which they don't hold. You're emailed either way, which tells you it happened but does not stop it. That's the reason the second factor you sign in with matters more on hosted than anywhere else.
Is the audit log tamper-proof?
Tamper-evident, which is the honest word. Each entry is hash-chained and ed25519-signed, so an edit made without the signing key breaks the chain and the console says so. Deleting the whole log is obvious. Someone who also holds the signing key could rewrite it, and on a gateway you run that key sits beside the log. Removing only the newest entries is detectable only against a checkpoint kept elsewhere.
Running it
What happens if my machine is asleep?
A local or tunneled gateway can't answer, so calls to it fail: nothing is queued and nothing runs later without you. If agents need to reach your tools around the clock, that's what hosted execution is for.
What happens if permaura.com goes down?
Your local gateway keeps working. Registration is a one-time handshake, not a runtime dependency: once you're activated, a local gateway enforces policy and serves agents entirely offline. You'd lose the console and remote sign-in until we're back.
Can I run more than one gateway?
One per workspace. Extra workspaces (and so extra gateways) come with the paid plans. See Workspaces & organizations.
Can my team share this?
Yes, on Team: shared policies, a member for every seat you pay for, role-based access, and per-workspace membership so someone can have access to one environment and not another.
Money
Is there a free tier?
Yes, and it isn't a trial. Local is free, unlimited, forever: the whole loop of connections, policies, grants and a signed audit log. The paid line is reach: a managed public URL for your gateway, hosted execution, more workspaces, team governance. See Plans.
Do I need a card to try a paid plan?
Yes, and nothing is charged until day 7. Cancel before then and you pay nothing.
What happens if I stop paying?
You drop to Free, not to nothing. The local loop keeps running; you lose the paid reach features. A hosted gateway is paused for a grace period (until 30 days after the end of the period you paid for, or 7 after a trial), then kept for 96 hours so you can export its vault, and then deleted with everything in it unless you pay again first. A managed tunnel stops answering when the pause starts and is deleted at the same point, though its permaura.app name stays reserved for your gateway. See Trials & billing.
Getting unstuck
An agent says it can't do something. Why?
Deny-by-default is doing its job. Open the audit log: the denied entry names the capability and connection, which tells you what to allow. Troubleshooting walks the rest of the causes.
Something is running that shouldn't be. How do I stop it?
Hit the connection's kill switch, or stop the gateway. Both take effect immediately. Uninstall & reset covers the full set of off-switches.
How do I delete my account?
Settings → Account → Delete account. Password, then a confirmation link by email, then it's gone, including any organization where you're the only owner. Cancel a live subscription, remove any hosted gateway, and disconnect any gateway other people still use, first. A hosted gateway's encrypted backups, sealed credentials included, outlive its teardown by up to 38 days. See Uninstall & reset.
My question isn't here.
Search this site (press ⌘K), or email support@permaura.com. To ask where other users can read the answer, see Ask in public.