Generate a Paperclip company key

If you run agents in Paperclip, a company key lets them call through AgentValet without each one holding its own keypair. The Paperclip adapter signs each request with the company’s private key and names the AgentValet agent it’s acting as; the proxy verifies the signature against the public key you registered here, then applies that agent’s grants, policies, approvals and audit exactly as it would for any other call.

It’s not a general-purpose API key. Every call still acts as a specific, active AgentValet agent in your organisation.

Where

/settings → Integrations card (collapsible) → Paperclip. The card appears on paid plans.

It starts with Your credentials: your Owner ID (hover to reveal) and the Proxy URL.

Generating a keypair

Under Company key → Generate keypair, click Generate keypair. There’s no form: AgentValet generates an RS256 keypair, stores the public key and hands you the private key once.

A modal then shows “Company keypair generated!” with:

Private key (RS256) — set as AGENTVALET_COMPANY_KEY — copy this now; it’s never shown again and never stored
Copy private key button

Tick I have copied my private key to enable Done. The modal can’t be dismissed any other way.

Or paste your own public key

If you generated a keypair yourself (openssl, Node.js), use Paste your own public key instead:

The public key PEM
Label (optional)
Paperclip Company ID (optional) — ties the key to one Paperclip company

Click Register key. “Public key registered successfully.” confirms.

Setting it up in Paperclip

Below the keys, the card shows the environment variables to set in your Paperclip instance:

AGENTVALET_PROXY_URL
AGENTVALET_OWNER_ID
AGENTVALET_COMPANY_KEY — the private key, with newlines escaped

Right after you generate a keypair, a copy-all button fills in the key for you. Once you leave the page, the key isn’t retrievable.

Listing and revoking

Registered keys lists every company key with its label, the Paperclip company (if set), when it was added and when it was last used (or “Never used”). Revoked keys show a REVOKED badge.

Click Revoke on a key. The row asks “Revoke?”; click Confirm. The key stops working immediately — the next request signed with it fails.

If you lose the private key

You can’t recover it. Generate a new keypair, update AGENTVALET_COMPANY_KEY in Paperclip, and revoke the lost one.

When NOT to use a company key

Your agent runs outside Paperclip. Register it as a normal agent (CLI / MCPB) with its own keypair.
You want to share approval duty with a teammate. Use approval delegation instead.