Providers / Foo Guard
Other
Foo Guard API keys and credentials
What every Foo Guard credential a founder holds does, whether it expires, and what tends to break. Each fact links to Foo Guard's own docs.
Our research on Foo Guard is still thin. Treat this page as a starting point and check the linked docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Gateway slot token (agt_slot_) | You choose, max 1 year | Can be scoped |
| Analysis API key (agt_live_ personal, agt_team_ organization) | Not documented | Not documented |
| Foo Guard account login | Not documented | – |
Each credential
Gateway slot token (agt_slot_)
- You choose, max 1 year
- Can be scoped
Live since 2026-11-09. An admin creates one per key slot (a Team MCP server or a Personal connection) on the connection's page, picks the expiry (at most a year), and sees the token once. It can only replace that one slot's key. Up to 3 live tokens per slot. Revoking it, or disconnecting its connection, ends it.
Analysis API key (agt_live_ personal, agt_team_ organization)
- Not documented
Used by the CLI, the GitHub Action and the analyze API as a Bearer token. Personal keys need Pro; organization service keys need Team. Shown in full once, stored as a hash; a revoked key returns 401. Created under Dashboard, Developer, API Access (personal) or Team settings, API keys. Not used by StackHangar push targets.
Foo Guard account login
- Not documented
Dashboard sign-in. Not an API credential. Team workspaces may require company sign-in. Session policy not researched.
What usually goes wrong
- Slot token expires and the next rotation push fails with unauthorized until a new token is made
- The provider key was rotated by hand in the provider but not replaced in Foo Guard, so agent calls through the gateway start failing
- A rotation is refused because the upstream server's tools changed since the last review; an admin must review the new tools in Foo Guard first
- The old provider key is revoked before the push, so calls already in flight can end uncertain
Renewals and billing
- Foo Guard Pro or Team plan. Pro covers personal Gateway connections and API keys; Team covers shared Gateway servers. Billing intervals were not researched. Gateway key slots stop accepting replacements when the plan lapses.
Free, Pro and per-user Team plans per the pricing page. Spend and usage APIs not researched.
What Foo Guard's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Slot tokens and the replace endpoint went live on 2026-11-09; only the browser preflight and an unauthenticated request were checked live
- Analysis API key lifetime, expiry visibility and scoping
- Account login session and SSO policy
- Billing intervals, spend API and usage API
Rotating or replacing a Foo Guard key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
Keep track of every Foo Guard key
StackHangar stores your Foo Guard keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.