Using BlinkMetrics Gatekeeper

Introduction

In this guide, we’ll go over how to set up BlinkMetrics Gatekeeper so an AI agent or script can safely work with your connected tools, without it ever holding your real API credential.

Gatekeeper is a relay that sits between your agent and the API. The agent makes the exact same requests it would normally make (same paths, same parameters, same request bodies) but sends them to Gatekeeper and authenticates with a Gatekeeper key instead of your real credential. Gatekeeper checks the key, applies your rules, attaches the real credential, forwards the request, and returns the API’s response unchanged.

What you get:

• Your real credential never leaves BlinkMetrics. The agent only ever holds a Gatekeeper key.
• Read-only keys. A rule that blocks anything except reading, no matter what the agent tries.
• Keys you can expire and revoke. Each key has its own expiration, and you can revoke one at any time without touching the others.
• Requests show up in Activity. Allowed and blocked, so you can see what ran.

You’ll need a Connection in BlinkMetrics first. This guide uses Asana as the example. If you haven’t connected it yet, start with Connecting to Asana. Gatekeeper support is rolling out to more connected tools over time.

How It Works

Only two things about your API calls change: where you send them and which credential you send. Here’s the same Asana call both ways:

# Calling Asana directly: your real Asana token travels with the request
curl https://app.asana.com/api/1.0/users/me \
  -H "Authorization: Bearer {your-real-asana-token}"

# Calling through Gatekeeper: the agent only ever holds the Gatekeeper key
curl https://gatekeeper.blinkmetrics.com/api/1.0/users/me \
  -H "Authorization: Bearer blink_gk_{your-gatekeeper-key}"

The path, query parameters, and request body pass through exactly as you send them (headers too, apart from the credential swap and standard connection-level headers), and the response comes back exactly as the API returned it. That means you follow Asana’s own API documentation for everything: Gatekeeper doesn’t need its own endpoint reference, because it doesn’t have endpoints. It relays whatever the underlying API supports.

The Gatekeeper base URL is:

https://gatekeeper.blinkmetrics.com

The key identifies which connection to use, so there’s nothing else to configure in the URL.

Create a Gatekeeper Key

1. Click the Settings cog icon in the header and select Connections, then open the connection you want the agent to use. For this guide, that’s your Asana connection.
2. Find the Gatekeeper panel on the connection page and click Create Key.
3. Name the key after who or what will use it, for example “Claude - read Asana tasks”. One key per agent or tool keeps Activity easy to read and lets you revoke one without disturbing the rest.
4. Leave the Rule dropdown set to Read-only (the default) if the agent only needs to look things up: it allows reads (GET requests) and blocks anything that creates, changes, or deletes. Choose Read & Write only when the agent genuinely needs to make changes. Finer-grained rules are on the way.
5. Set the expiration. It defaults to 30 days out; tick Never expires if you want a permanent key. Keys expire at the end of the chosen day (UTC).
6. Click Generate Key and copy the key now: it starts with blink_gk_ and is shown only this once. BlinkMetrics stores a fingerprint of it, not the key itself, so if you lose it, revoke it and create a new one.

Treat the key like a password: it grants whatever access you gave it, to anyone who holds it.

Using Gatekeeper with an AI Agent

The most common way to use Gatekeeper is to hand a key to an AI agent (Claude, a custom script, an automation) so it can work with your tools safely. There are two ways to teach your agent what the key is.

Claude Code: install the skill

If your agent is Claude Code, install our free blink-gatekeeper skill into your project:

mkdir -p .claude/skills/blink-gatekeeper
curl -fsSL -o .claude/skills/blink-gatekeeper/SKILL.md \
  https://raw.githubusercontent.com/nsquared-team/blink-gatekeeper/main/SKILL.md

That’s the whole install. Claude discovers the skill on its own, so plain-language requests just work:

Get the title and description of https://app.asana.com/1/…/task/1234567890 using gatekeeper credential blink_gk_…

The skill carries the base URL, parses Asana links into API calls, interprets every Gatekeeper error, and follows strict key-handling rules (the key is only ever sent to Gatekeeper, never echoed or logged). To install it for every project on your machine, put it in ~/.claude/skills/blink-gatekeeper/ instead.

Any other agent: paste this prompt

For any other agent or tool, paste this prompt along with your key, and it will know exactly what to do:

You can work with the Asana API through BlinkMetrics Gatekeeper, a relay that
holds the real Asana credential so you don't have to.

- Build requests exactly as Asana's API documentation describes:
  https://developers.asana.com/reference/rest-api-reference
- Send them to this base URL instead of https://app.asana.com:
  https://gatekeeper.blinkmetrics.com
  Keep the full path, query parameters, headers, and body unchanged
  (for example: GET /api/1.0/users/me).
- Authenticate every request with this header:
  Authorization: Bearer {paste your blink_gk_... key here}
  This is a Gatekeeper key, not an Asana token. Never send it to any host
  other than the base URL above.
- A 403 response mentioning "read-only mode" means this key only allows GET
  requests. Report it and move on; do not retry the request.
- A 401 response saying "Invalid or expired Gatekeeper key" means the key
  needs to be replaced. Stop and ask for a new one.
- Full Gatekeeper documentation, if you need it:
  https://blinkmetrics.com/guides/gatekeeper/

Task: {describe what you want the agent to do}

Yes, that puts the key in your conversation history. That’s exactly why you’re handing over a scoped, expiring key instead of your real token: use read-only where you can, and revoke the key when the work is done.

Using Gatekeeper with a different connected tool? Same prompt; just swap the Asana references and documentation link for the other tool’s.

Make Your First Request

Prefer to try it by hand first? With your key in place of the placeholder, run this in your terminal to ask Asana who you are:

curl https://gatekeeper.blinkmetrics.com/api/1.0/users/me \
  -H "Authorization: Bearer blink_gk_{your-gatekeeper-key}"

You’ll get back Asana’s own response, exactly as if you had called Asana directly:

{
  "data": {
    "gid": "1200000000000001",
    "email": "[email protected]",
    "name": "Your Name",
    "resource_type": "user",
    "workspaces": [
      {
        "gid": "1200000000000002",
        "name": "yourcompany.com",
        "resource_type": "workspace"
      }
    ]
  }
}

From here, any Asana endpoint works the same way. Swap in the path and parameters from Asana’s docs:

# List projects in a workspace
curl "https://gatekeeper.blinkmetrics.com/api/1.0/projects?workspace=1200000000000002" \
  -H "Authorization: Bearer blink_gk_{your-gatekeeper-key}"

# Create a task (needs a key whose Rule is Read & Write)
curl -X POST "https://gatekeeper.blinkmetrics.com/api/1.0/tasks" \
  -H "Authorization: Bearer blink_gk_{your-gatekeeper-key}" \
  -H "Content-Type: application/json" \
  -d '{"data": {"name": "Follow up with new leads", "projects": ["1200000000000003"]}}'

Responses and Errors

On a successful call, what you get back is the API’s response; Gatekeeper doesn’t reshape it. When Gatekeeper itself has something to say, it answers with JSON in this shape:

{
  "error": true,
  "message": "POST is not allowed. This key is set to read-only mode (GET requests only)."
}

Status	Message	What it means
401	Missing or malformed Authorization header.	The request has no Authorization: Bearer … header.
401	Invalid or expired Gatekeeper key.	The key is mistyped, revoked, or past its expiration. Create a new key.
401	The tool connection this key proxies is no longer authorized. Reconnect it in BlinkMetrics (Connections → the connection → Reconnect), then retry. The Gatekeeper key itself is still valid.	The underlying connection needs to be reconnected in BlinkMetrics. The key itself is fine.
403	method is not allowed. This key is set to read-only mode (GET requests only).	A read-only key tried a write. If the write is intended, create a key with the Rule set to Read & Write.
429	(varies)	Rate limiting, usually the API’s own limits passing through. Wait for the Retry-After header, then retry.
502 / 503 / 504	(varies)	A temporary problem reaching the API or verifying the key. Retry shortly.

See What Ran

Every request made with a valid key (allowed or blocked by its rules) appears in the Activity feed on the connection page: when it ran, the method and path, the outcome, the response status, and how long it took. Blocked requests show up too, so you can see what an agent tried to do, not just what went through. (Requests rejected with a 401 for a missing, mistyped, expired, or revoked key are not logged.) There’s nothing to set up; it’s on for every key.

Revoke a Key

On the connection’s Gatekeeper panel, click Revoke next to the key, then confirm with Yes. Revocation takes effect within about half a minute, and the key answers 401 Invalid or expired Gatekeeper key from then on. Revoking one key never affects the others, and the connection itself keeps working normally in BlinkMetrics.

Keys with an expiration stop working on their own at the end of their chosen day (UTC), with nothing to clean up.