@@ -137,12 +137,70 @@ interceptor = KeycardInterceptor(
 )
 ```
 
+## The OpenAI Agents plugin
+
+`temporalio.contrib.openai_agents.OpenAIAgentsPlugin` runs every model call as an activity of its own, registered by the plugin before any of your activities exist, so neither `@grant` nor the interceptor can hand it a credential. `keycardai.temporal.openai_agents.KeycardOpenAIProvider` fills that seat: a `ModelProvider` whose OpenAI client resolves its key through Keycard on each request instead of reading `OPENAI_API_KEY` once at startup.
+
+```bash
+pip install "keycardai-temporal[openai-agents]" "temporalio[openai-agents]"
+```
+
+The intended end state for a worker: the interceptor once, `@grant` on each activity, and the plugin configured through Keycard for the model.
+
+```python
+from datetime import timedelta
+
+from temporalio.client import Client
+from temporalio.contrib.openai_agents import ModelActivityParameters, OpenAIAgentsPlugin
+from temporalio.worker import Worker
+
+from keycardai.temporal import KeycardInterceptor, access, grant
+from keycardai.temporal.openai_agents import KeycardOpenAIProvider
+
+ZONE = "https://your-zone.keycard.cloud"
+
+
+@grant("urn:mongodb:atlas:orders")
+async def load_orders(customer_id: str) -> list[dict]:
+    return await atlas_client(access().access_token).find(customer_id)
+
+
+async def main() -> None:
+    client = await Client.connect(
+        "localhost:7233",
+        plugins=[
+            OpenAIAgentsPlugin(
+                model_params=ModelActivityParameters(
+                    start_to_close_timeout=timedelta(seconds=60)
+                ),
+                model_provider=KeycardOpenAIProvider(
+                    ZONE, "urn:vault:openai-api-key", refresh=timedelta(minutes=5)
+                ),
+            )
+        ],
+    )
+    worker = Worker(
+        client,
+        task_queue="orders",
+        workflows=[OrderWorkflow],
+        activities=[load_orders],
+        interceptors=[KeycardInterceptor(ZONE)],
+    )
+    await worker.run()
+```
+
+`KeycardOpenAIProvider(zone_url, resource, credential=None, *, refresh=timedelta(minutes=5), base_url=None, use_responses=None)` takes the zone URL and the identifier of the resource whose vault holds the OpenAI key. The credential is the same as the interceptor's: an explicit `ApplicationCredential`, or the one `discover_credential()` finds in the environment when omitted. It must be a `ClientSecret`, as for any client-credentials `@grant`; other credential types raise `GrantConfigurationError` at construction.
+
+Refresh: the key is minted with a client-credentials grant on the first model call, not at worker startup, and reused for `refresh` (or the grant's `expires_in`, whichever is shorter). The next model call after the window mints again, so a key rotated in Keycard reaches the worker within one refresh window, with no restart. Concurrent model calls on an expired cache share one mint. A permanent grant failure fails the model activity with the same non-retryable `KeycardAccessDenied` a `@grant` activity would raise; a transient one is left to the model activity's retry policy. The plugin requires an explicit `start_to_close_timeout` or `schedule_to_close_timeout` whenever a custom provider is set.
+
+The optional dependencies (`openai-agents`, `openai`) are imported only inside `keycardai.temporal.openai_agents`, and only when a provider is built; `import keycardai.temporal` stays free of them. Without the extra installed, building a provider raises an `ImportError` naming it. `temporalio[openai-agents]` itself stays yours to install, since its version is pinned by your worker, not by this package.
+
 ## Design notes
 
 - Tokens never touch durable state. Workflow history is replayable and permanent, so unlike header-based context-propagation interceptors, nothing is written to activity headers, arguments, or return values. The token exists only inside one execution's context. This is also why on-behalf-of activities receive an identity reference instead of a token: the session lookup and exchange happen at the edge, inside the execution, so a session revoked mid-workflow is never replayed from state.
 - A mint failure for any declared resource raises before the activity body runs, and there is no fallback path. Tokens live in the SDK's shared `AccessContext` (the same container `keycardai-mcp` uses), but where that idiom is non-throwing, the interceptor converts recorded errors into raises on purpose: in Temporal, raising is the error channel.
 - Transient mint failures are retryable; permanent failures are not. The classification is `keycardai-oauth`'s: every typed error carries a `retryable` property, and `exchange_tokens_for_resources` records it in the error dict it stores on the `AccessContext`. Network failures, 5xx and 429 responses, and unclassified errors let the activity retry policy govern what happens next, while permanent failures (`access_denied`, `insufficient_authorization`, `invalid_client`, other 4xx responses, configuration and authentication errors) raise `ApplicationError(type="KeycardAccessDenied", non_retryable=True)` immediately. Misdeclarations surface as `GrantConfigurationError`, retryable by default so a worker redeploy with the fix lets the next retry succeed; list `"GrantConfigurationError"` in the retry policy's `non_retryable_error_types` to give up sooner.
-- No token caching, per Keycard's credential rules; per-call mint is the contract. One OAuth client is created per worker and reused; only the tokens are fresh.
+- No token caching, per Keycard's credential rules; per-call mint is the contract. One OAuth client is created per worker and reused; only the tokens are fresh. The one exception is the OpenAI Agents provider's model key, which is a vaulted third-party secret rather than a Keycard token: it is reused for a short `refresh` window rather than minted per request, and re-minted after it, so rotation still propagates without a restart.
 - The package wraps its own `keycardai` imports in `workflow.unsafe.imports_passed_through()`, the idiom from Temporal's sentry sample, so consumers import it normally even in files that define workflows.
 - Works with async activities and with sync activities on the thread-pool executor (the Temporal SDK copies contextvars into the thread). Sync activities on a process-pool executor are not supported because contextvars do not cross processes.
 
@@ -152,4 +210,4 @@ interceptor = KeycardInterceptor(
 cd packages/temporal && uv run --extra test pytest tests/ -v
 ```
 
-`tests/test_interceptor.py` drives the interceptor chain directly with the OAuth client stubbed. `tests/test_history_hygiene.py` runs a real workflow against a local Temporal dev server (downloaded by `temporalio` on first use), then scans the recorded history, including base64-decoded payloads, and asserts the minted token appears nowhere. Neither needs a Keycard zone.
+`tests/test_interceptor.py` drives the interceptor chain directly with the OAuth client stubbed. `tests/test_openai_agents.py` covers the OpenAI Agents provider with the OAuth client stubbed and the clock faked; two tests that need the Agents SDK and the real plugin skip unless the `openai-agents` extra (and `temporalio[openai-agents]`) is installed. `tests/test_history_hygiene.py` runs a real workflow against a local Temporal dev server (downloaded by `temporalio` on first use), then scans the recorded history, including base64-decoded payloads, and asserts the minted token appears nowhere. Neither needs a Keycard zone.
@@ -26,6 +26,10 @@ classifiers = [
 ]
 
 [project.optional-dependencies]
+openai-agents = [
+    "openai-agents>=0.20.0",
+    "openai>=2.45.0",
+]
 test = [
     "pytest>=8.4.1",
     "pytest-asyncio>=1.1.0",
 
@@ -41,7 +41,7 @@
 import inspect
 from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, fields
-from typing import Annotated, Any, get_args, get_origin, get_type_hints
+from typing import Annotated, Any, NoReturn, get_args, get_origin, get_type_hints
 
 from temporalio import workflow
 from temporalio.exceptions import ApplicationError
@@ -337,6 +337,20 @@ def access(resource: str | None = None) -> TokenResponse:
     return ctx.access(resource)
 
 
+def _worker_credential(
+    credential: ApplicationCredential | None,
+) -> ApplicationCredential:
+    """The explicit credential, or the one the environment describes."""
+    if credential is not None:
+        return credential
+    try:
+        return discover_credential()
+    except CredentialDiscoveryError as e:
+        # Same taxonomy as every other worker-configuration problem in this
+        # package, so retry policies see one error class.
+        raise GrantConfigurationError(str(e)) from e
+
+
 class KeycardInterceptor(Interceptor):
     """Worker interceptor that mints fresh Keycard tokens per activity execution.
 
@@ -371,13 +385,7 @@ def __init__(
         credential: ApplicationCredential | None = None,
         subject_token_provider: SubjectTokenProvider | None = None,
     ) -> None:
-        if credential is None:
-            try:
-                credential = discover_credential()
-            except CredentialDiscoveryError as e:
-                # Same taxonomy as every other worker-configuration problem
-                # in this package, so retry policies see one error class.
-                raise GrantConfigurationError(str(e)) from e
+        credential = _worker_credential(credential)
         self._credential = credential
         # One client for the worker's lifetime: endpoint discovery runs once
         # and is cached on the instance. Tokens are still minted per call;
@@ -428,15 +436,7 @@ async def _mint(self, grant: _Grant, input: ExecuteActivityInput) -> AccessConte
                         resource=resource
                     )
                 except Exception as e:
-                    if not error_retryable(e):
-                        code = getattr(e, "error", None) or type(e).__name__
-                        raise ApplicationError(
-                            f"Keycard grant for {resource} failed permanently: "
-                            f"{code}: {e}",
-                            type="KeycardAccessDenied",
-                            non_retryable=True,
-                        ) from e
-                    raise  # transient: the activity retry policy governs it
+                    _raise_for_grant_failure(resource, e)
                 ctx.set_token(resource, resp)
         elif grant.impersonate:
             # client.impersonate() authenticates only at the HTTP layer, and
@@ -497,6 +497,22 @@ async def execute_activity(self, input: ExecuteActivityInput) -> Any:
             _ctx.reset(token)
 
 
+def _raise_for_grant_failure(resource: str, e: Exception) -> NoReturn:
+    """Classify a failed client-credentials grant the way the interceptor does.
+
+    Permanent failures become the non-retryable ``KeycardAccessDenied``;
+    transient ones re-raise as-is so the activity retry policy governs them.
+    """
+    if not error_retryable(e):
+        code = getattr(e, "error", None) or type(e).__name__
+        raise ApplicationError(
+            f"Keycard grant for {resource} failed permanently: {code}: {e}",
+            type="KeycardAccessDenied",
+            non_retryable=True,
+        ) from e
+    raise e
+
+
 def _raise_on_mint_error(ctx: AccessContext, *resources: str) -> None:
     """Raise for the first failed resource, permanent failures first.
 
 
@@ -0,0 +1,207 @@
+"""Keycard-minted OpenAI credential for temporalio's OpenAI Agents plugin.
+
+``OpenAIAgentsPlugin`` runs every model call as a Temporal activity of its
+own, and that activity asks its ``ModelProvider`` for a model on each call.
+Neither ``@grant`` nor :class:`keycardai.temporal.KeycardInterceptor` can
+reach that activity: the plugin registers it and builds its OpenAI client
+before any consumer activity exists. :class:`KeycardOpenAIProvider` closes
+the gap from the provider side. It hands the OpenAI client an async key
+callback instead of a key string, and the client awaits that callback before
+every request it sends. The callback mints the OpenAI key from a vaulted
+Keycard resource with a client-credentials grant and caches it for a short
+``refresh`` window, so a key rotated in Keycard is picked up by the next
+model call after the window closes, with no worker restart.
+
+Optional dependencies (``openai``, ``agents``) are imported only here, and
+only when a provider is built, so ``import keycardai.temporal`` stays clean
+without the ``openai-agents`` extra.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import time
+from datetime import timedelta
+from typing import TYPE_CHECKING, Any
+
+from temporalio import workflow
+
+with workflow.unsafe.imports_passed_through():
+    from keycardai.oauth import AsyncClient
+    from keycardai.oauth.server import ApplicationCredential, ClientSecret
+
+from keycardai.temporal import (
+    GrantConfigurationError,
+    _raise_for_grant_failure,
+    _worker_credential,
+)
+
+if TYPE_CHECKING:
+    from agents import Model, ModelProvider
+
+    _ProviderBase = ModelProvider
+else:
+    # Duck-typed at runtime so this module imports without ``agents``; the
+    # plugin only ever calls get_model() and aclose().
+    _ProviderBase = object
+
+__all__ = ["KeycardOpenAIKey", "KeycardOpenAIProvider"]
+
+_MISSING_EXTRA = (
+    "keycardai.temporal.openai_agents needs the OpenAI Agents SDK and the openai "
+    "client: install keycardai-temporal[openai-agents] next to "
+    "temporalio[openai-agents]."
+)
+
+
+def _openai_deps() -> tuple[Any, Any]:
+    """Import the optional dependencies on first use: (OpenAIProvider, AsyncOpenAI)."""
+    try:
+        from agents.models.openai_provider import OpenAIProvider
+        from openai import AsyncOpenAI
+    except ImportError as e:
+        raise ImportError(_MISSING_EXTRA) from e
+    return OpenAIProvider, AsyncOpenAI
+
+
+class KeycardOpenAIKey:
+    """Async callable returning the OpenAI key vaulted behind a Keycard resource.
+
+    Shaped for ``openai.AsyncOpenAI(api_key=...)``, which awaits it before
+    each request. The key is minted with a client-credentials grant and
+    cached for ``refresh`` (bounded by the grant's ``expires_in`` when the
+    zone reports a shorter one); concurrent callers on a cold or expired
+    cache share one mint. A permanent grant failure raises the same
+    non-retryable ``KeycardAccessDenied`` ``ApplicationError`` the
+    interceptor raises, so the plugin's model activity fails the same way a
+    ``@grant`` activity would; a transient failure propagates as-is and the
+    model activity's retry policy governs it.
+
+    Args:
+        zone_url: Keycard zone issuer URL.
+        resource: Identifier of the vaulted OpenAI key resource in the zone.
+        credential: How this application authenticates to the zone; when
+            omitted, discovered from the environment exactly as
+            :class:`keycardai.temporal.KeycardInterceptor` does. Must be a
+            ``ClientSecret`` (the client-credentials path has no bridge for
+            assertion credentials yet).
+        refresh: How long a minted key is reused before the next call mints
+            again. Default five minutes.
+
+    Raises:
+        GrantConfigurationError: the credential could not be discovered, or
+            is not a ``ClientSecret``.
+    """
+
+    def __init__(
+        self,
+        zone_url: str,
+        resource: str,
+        credential: ApplicationCredential | None = None,
+        *,
+        refresh: timedelta = timedelta(minutes=5),
+    ) -> None:
+        credential = _worker_credential(credential)
+        if not isinstance(credential, ClientSecret):
+            raise GrantConfigurationError(
+                f"{type(self).__name__} for {resource} mints with client "
+                "credentials, which requires a ClientSecret credential; the "
+                f"worker has {type(credential).__name__}."
+            )
+        if refresh <= timedelta(0):
+            raise GrantConfigurationError(
+                f"{type(self).__name__}: refresh must be positive, got {refresh}."
+            )
+        self.resource = resource
+        self.refresh = refresh
+        self._client = AsyncClient(zone_url, auth=credential.get_http_client_auth())
+        self._key: str | None = None
+        self._fresh_until = 0.0
+        self._lock = asyncio.Lock()
+
+    def _cached(self) -> str | None:
+        if self._key is not None and time.monotonic() < self._fresh_until:
+            return self._key
+        return None
+
+    async def __call__(self) -> str:
+        key = self._cached()
+        if key is not None:
+            return key
+        async with self._lock:
+            key = self._cached()
+            if key is not None:
+                return key
+            try:
+                resp = await self._client.client_credentials_grant(
+                    resource=self.resource
+                )
+            except Exception as e:
+                _raise_for_grant_failure(self.resource, e)
+            window = self.refresh.total_seconds()
+            if resp.expires_in is not None:
+                window = min(window, float(resp.expires_in))
+            self._key = resp.access_token
+            self._fresh_until = time.monotonic() + window
+            return self._key
+
+    async def aclose(self) -> None:
+        """Close the Keycard client; the next call opens a fresh one."""
+        self._key = None
+        self._fresh_until = 0.0
+        await self._client.aclose()
+
+
+class KeycardOpenAIProvider(_ProviderBase):
+    """``agents.ModelProvider`` whose OpenAI key comes from Keycard per call.
+
+    Pass it as ``OpenAIAgentsPlugin(model_provider=...)``. Models come from
+    the SDK's own ``OpenAIProvider`` over one ``AsyncOpenAI`` client that
+    carries a :class:`KeycardOpenAIKey` in place of a key string, so every
+    request the plugin's model activity sends first resolves (and, past the
+    ``refresh`` window, re-mints) the key. ``max_retries`` on that client
+    is 0, as in the plugin's default provider, so the model activity's
+    retry policy is the only retry loop.
+
+    The plugin requires an explicit ``start_to_close_timeout`` or
+    ``schedule_to_close_timeout`` in ``ModelActivityParameters`` whenever a
+    custom provider is set; it only defaults the timeout for its own.
+
+    Args:
+        zone_url, resource, credential, refresh: as :class:`KeycardOpenAIKey`.
+        base_url: OpenAI-compatible base URL, when not api.openai.com.
+        use_responses: Forwarded to ``OpenAIProvider`` (Responses API vs
+            Chat Completions); ``None`` keeps the SDK default.
+
+    Raises:
+        GrantConfigurationError: as :class:`KeycardOpenAIKey`.
+        ImportError: the ``openai-agents`` extra is not installed.
+    """
+
+    def __init__(
+        self,
+        zone_url: str,
+        resource: str,
+        credential: ApplicationCredential | None = None,
+        *,
+        refresh: timedelta = timedelta(minutes=5),
+        base_url: str | None = None,
+        use_responses: bool | None = None,
+    ) -> None:
+        OpenAIProvider, AsyncOpenAI = _openai_deps()
+        self.api_key = KeycardOpenAIKey(zone_url, resource, credential, refresh=refresh)
+        self._openai = AsyncOpenAI(
+            api_key=self.api_key, base_url=base_url, max_retries=0
+        )
+        self._provider = OpenAIProvider(
+            openai_client=self._openai, use_responses=use_responses
+        )
+
+    def get_model(self, model_name: str | None) -> Model:
+        return self._provider.get_model(model_name)
+
+    async def aclose(self) -> None:
+        """Release the inner provider, the OpenAI client, and the Keycard client."""
+        await self._provider.aclose()
+        await self._openai.close()
+        await self.api_key.aclose()