Akeyless
Akeyless is a secrets management and machine identity platform built on zero-knowledge encryption and Distributed Fragments Cryptography (DFC). This connector exposes the Akeyless REST API through your Akeyless SaaS endpoint or a self-hosted Gateway — the same backend that powers the Akeyless MCP server (akeyless mcp).
Use it to list and manage static, dynamic, and rotated secrets; browse folders and targets; inspect and create auth methods; and work with roles and RBAC — all scoped by the Access Role attached to your API Key auth method.
Authentication Types
Akeyless supports one authentication method in this connector:
- Client Credentials (API Key) — Access ID + Access Key pair from an API Key auth method
- Pros: Simple programmatic setup, works with SaaS and self-hosted Gateways, automatic token refresh
- Cons: API Key auth methods are intended for automation/POC; prefer SAML/OIDC/K8s auth methods for production human access (not yet exposed in this connector)
Configuration
| Field | Description | Example |
|---|---|---|
| API base URL | Root URL for REST calls (no trailing slash) | https://api.akeyless.io (SaaS) or https://vault.example.com:8000/api/v2 (Gateway) |
The Token URL (set during credential setup) must match your deployment:
| Deployment | Token URL | API base URL |
|---|---|---|
| Akeyless SaaS | https://api.akeyless.io/auth | https://api.akeyless.io |
| Self-hosted Gateway | https://<gateway>:8000/api/v2/auth | https://<gateway>:8000/api/v2 |
These mirror the --gateway-url flag required by akeyless mcp (see MCP Server docs).
Setting up API Key authentication
- Sign in to the Akeyless Console.
- Go to Administration → Users & Auth Methods → + New → API Key.
- Name the auth method and download the CSV with Access ID and Access Key (shown once).
- Go to Access Roles, open a role with the permissions you need, and Associate the new auth method.
- In Willow, choose Client Credentials auth:
- Client ID = Access ID
- Client Secret = Access Key
- Token URL = auth endpoint from the table above
- Set API base URL to the matching API root from the table above.
Relationship to the Akeyless MCP server
The official Akeyless MCP integration runs akeyless mcp locally over stdio in Cursor or Claude Desktop. This Willow connector is not a proxy of that stdio server — it calls the same Akeyless Gateway REST API directly from the Willow platform, which suits team-wide MCP servers, guardrails, and audit logging in Willow.
For Agentic Runtime Authority tools (list-secrets, query-db, service-execute), use akeyless mcp-runtime-authority locally or ask your admin about ARA-enabled secrets.
Troubleshooting
Authentication failed / invalid credentials
Cause: Access ID and Access Key mismatch, rotated key, or wrong Token URL for your deployment (SaaS vs Gateway).
Solution: Verify the pair belongs to the same auth method, confirm the Token URL ends with /auth, and re-test with akeyless auth --access-id ... --access-key ....
Permission denied on secrets or folders
Cause: The API Key auth method is not associated with a role that has rules for the requested path.
Solution: In the Console, associate the auth method with a role that includes the needed path rules, or scope agent tools to allowed prefixes.
Gateway URL confusion
Cause: MCP docs use --gateway-url https://host:8000/api/v2 while some CLI commands use port 8080 or omit /api/v2.
Solution: Use the exact Gateway URL shown in your Console under Gateway settings. Both the Token URL and API base URL should share the same host and /api/v2 prefix when using a Gateway.