Skip to main content
sesame launch -- <your agent> runs your agent with all of its brokered egress routed through Sesame. A local edge proxy intercepts outbound HTTPS, forwards calls to hosts you’ve stored a secret for to the broker (which injects the credential, gets approval, and audits), and splices everything else straight through. Your agent holds only dummy placeholders — the real keys live in Sesame and are injected on the wire.
This is different from Agent Skills. Skills teach an agent to call sesame request itself. Transparent egress requires no changes to the agent — it intercepts at the network layer, so the agent never knows Sesame is there.

​
How it works

1

`sesame launch` starts the edge proxy

It mints a proxy key, fetches your tenant root certificate, and starts the local sesame-proxyd edge proxy — then execs your agent with HTTPS_PROXY pointed at the proxy and the tenant root installed in the agent’s trust env (no sudo, no OS trust-store edits).
2

Brokered hosts are bumped; everything else splices

For a host you’ve stored a secret for, the proxy presents a leaf certificate the broker minted, reads the request, and forwards it to the broker’s /v1/proxy/http. Every other host is an opaque tunnel — never decrypted, never touches the broker.
3

The broker injects, approves, and audits

The broker strips whatever placeholder the agent sent, injects your real credential, applies your approval policy, forwards to the upstream, and logs the call. The secret never crosses back to the agent.

​
Connect your agent

Hermes

Onboard new or running Hermes Desktop, gateway, and CLI processes.

OpenClaw

Run your OpenClaw gateway through Sesame — LLM and tool calls injected server-side.

Any agent

Wrap any process that honors HTTPS_PROXY with sesame launch.

​
Universal steps

These run in a terminal on the host where the agent runs, not in the agent’s UI. If you’re an agent onboarding a UI-only user, first establish shell access to that host — search the working directory for SSH keys/config (~/.ssh/config, *.pem, deploy notes), verify with ssh <user>@<host> 'curl -fsS https://getsesame.dev/health', or ask the user how they reach the box — and confirm it can reach getsesame.dev before continuing.
1

Install the CLI + edge proxy

2

Register the agent

Approve the device in your getsesame.dev dashboard.
3

Store your keys in Sesame

Add a secret per provider in the dashboard (Secrets → Add), scoped to the provider’s hostname. See Providers for presets.
4

Replace the agent's real keys with dummies

So the agent holds nothing real. The exact step depends on the agent (see per-agent guides). When sesame police --neutralize ships, this becomes automatic.
5

Launch the agent through Sesame

Human-in-the-loop. sesame login (step 2), adding secrets (step 3), and the first call to each brokered host (after launch) all wait on a person in the getsesame.dev dashboard — approving the device, adding the secret, and approving the call. sesame login and brokered calls block until you act. If an agent is running these steps, it should pause and hand off to the user at each point rather than assume success.

​
Requirements & gotchas

Your agent’s egress must honor HTTPS_PROXY and the injected CA. sesame launch sets HTTPS_PROXY, SSL_CERT_FILE/NODE_EXTRA_CA_CERTS, and NODE_USE_ENV_PROXY=1 on the agent process. Agents that make calls in-process (e.g. OpenClaw) are intercepted correctly. Agents that execute tools in a remote or sandboxed environment off the box are not reached by env-based interception — those need transparent mode + iptables on the host where the tool actually runs. Confirm your agent’s LLM/tool calls run in-process before relying on sesame launch.
  • Approvals: every brokered call prompts by default. For your model host, set an auto-approve (or long-window) policy so chat flows; keep per-call approval on side-effecting hosts (payments, deletes).
  • Trust: sesame launch appends the tenant root to your system CA bundle, so spliced (non-brokered) hosts keep verifying normally. If a non-brokered host suddenly fails TLS, check your CA env isn’t being overridden elsewhere.
  • Verify it’s keyless: confirm the agent’s credential store holds only placeholders (see per-agent guides).
  • Registration is not mediation. sesame status only proves the device is registered, and a manual sesame launch -- curl wraps a fresh process — neither shows your agent is wrapped. Check the running agent’s own environment for HTTPS_PROXY. Unwrapped agents fail silently.