Run Python or JavaScript code safely in a micro-sandbox container. 1 endpoints from smolmachines, from $0.001 per call. Jobs that several providers do sit on one row, so you can compare price and coverage before you spend a call — choosing is yours; olywork does not route between providers automatically.
code.execute
Execute code in sandboxRun Python or JavaScript code safely in a micro-sandbox container.smolmachines · $0.001/call · smolmachines.code.execute
Connect an account once. olywork holds credentials server-side and relays upstream requests at the provider rate shown before execution — zero keys land on agent machines.
{{c.name}} is connected, but can't call the API on its own yet. {{c.extra_credential_note}}
{{staleConns.length}} connection{{staleConns.length===1?'':'s'}} need reconnecting.
olywork can't renew {{staleConns.length===1?'it':'them'}} automatically — without a fresh consent
{{staleConns.length===1?'it':'they'}} will stop working:
{{staleConns.map(c=>c.name).join(', ')}}
{{g.category}}{{g.total}}
{{g.hint}}
No catalogued platforms{{mkTabActive==='all'?'':' in '+mkTabActive}} on this server yet — the
Platform tab lists every integration you can connect.
{{g.category}} {{g.items.length}}{{g.hint}}
{{p.display_name}}{{p.summary}}
{{p.auth_kind==='key'?'API key':(p.auth_kind==='token'?'your own bot':'one-click')}}
{{c.name}} is connected, but can't call the API on its own yet. {{c.extra_credential_note}}
This server holds no client credentials for {{mkProvider.display_name}}, so the connect flow can't run here.
Connected accounts {{mkConns.length}}each account gets its own tool name, so an agent can call a specific one
No accounts yet. Connecting takes you to {{mkProvider.display_name}} to approve — olywork keeps the
credential server-side and injects it on every call.
Covered in the catalog {{mkPlatforms.length}}the platforms {{mkProvider.display_name}} serves — compare its endpoints with the other providers'
{{platInitial({label:platLabel, slug:platSlug})}}
{{platLabel}}
Every endpoint olywork knows for this platform, one ledger, filed by subject — jobs several
providers do sit on a single row, so you can compare price and coverage before you spend a call.
The catalog has no parameter reference for this endpoint yet — the provider's docs have them.
{{f}}
{{e.call_template}}
{{e.id}}
Loading the captured response…
{{platEx[e.id].err}}
{{platEx[e.id].text}}
Nothing on this platform matches that filter — clear it, or
.
{{orgMsg}}
Bring your own keys & skills
Call any of these with no key on your machine. Copy a snippet, or Try it here.
Register an upstream API here, then call it with no key on your machine.
⛁ Endpointan HTTP API, called through the proxy
⌘ CLIa command members run with the key injected
📄 From OpenAPI / Swaggerpaste a spec URL or JSON to auto-generate tools
▤ From the catalogbrowse ready-made endpoints by platform — many need no key
{{toolErr}}
Local runs are on for {{runNote}}. During a run the key is injected into that member's process - consider storing a restricted key (many providers offer read-only/scoped keys) rather than a full one.
📦
Import Custom API via OpenAPI / Swagger
Paste any JSON/YAML spec URL to auto-generate authenticated tools with agent SKILL.md recipes.
Nothing here{{q?' matches "'+q+'"':' yet'}}. This is your personal space - your team's tools live under another org. Switch to a team →
Nothing of your own yet — but you can already call the catalog of capabilities
Your team starts with $1.00 of free credit, so the catalog works before you register anything: find a tool by what it does, see the price, call it. Browse the catalog → When you're ready to add your own keys and skills — your .env and skill folders — load them here and they become callable tools for the whole team.
1 · Install the CLI & sign in
curl-fsSL{{proxy}}/install.sh | sh
olywork login
2 · Preview, then upload — it scans your .env + skill folders, you pick what to share.
One line, token included — your agent reads llms.txt, installs the CLI, signs in, and registers your skills + keys (read-only scan first, you approve).
Send someone this page's link, or paste this into a coding agent (Claude Code / Codex / Gemini) — it installs the CLI, signs them in as themselves, and pulls just this skill. Its credential{{detailData.secrets.length>1?'s stay':' stays'}} server-side — calls go through the proxy, no key lands on their machine.
Send someone this page's link, or paste this into a coding agent. Calls go through the proxy — the credential is injected server-side, never on their machine.
{{detailPrompt}}
Upstream
{{detailData.base_url}}
Credentials
{{w.label}} injected server-side on every call — the value never appears here or on a caller's machine.
none — a public upstream, no credential needed.
Examples
{{ex.method||'GET'}}{{ex.note||ex.path}}
CLI
olywork run {{detail.name}} -- <args>serverlocal-only⌘ run off
Guardrails
runs matching these patterns are refused before the key is injected: {{p}}
The credentials your tools inject. Values are encrypted server-side and never shown.
{{s.name}}
{{s.kind}}
owner: {{short(s.owner)}}
No secrets yet — add one below, or bulk-load everything at once (setup guide under the form).
Add {{secretRows.length>1?'secrets':'a secret'}}
Name a key after its catalog provider — e.g. {{keyNameSuggestions.slice(0,3).map(p=>p.service).join(', ')}} —
and catalog calls use it automatically. The name field suggests every provider that takes a pasted key.
Tip: paste a whole .env into the name field — it splits into rows automatically.
One line, token included — your agent reads llms.txt, installs the CLI, signs in, and registers your skills + keys (read-only scan first, you approve).
{{buildAgentPrompt('agent', true)}}
Team: {{activeName}}personal
You are {{activeRole}} here. Switch, create or join a team from the picker at the top of the sidebar.
Members, projects and policy are visible to admins.
Your usage today: {{myUsage.used_today}} / {{myUsage.cap}} calls.
{{orgErr}}
{{agentErr}}
Token for {{newAgent.name}} — copy it now
How to use {{snipAgent.name}}
This is the only time it is shown. Put it in the agent's OLYWORK_TOKEN.
✓ connected — {{newAgent.name}} called in as itselfwaiting for its first check-in…
Snippets carry the real token (minted this page-load — the server only keeps a hash).
The server stores only a hash of the token, so it can't be shown again — these snippets use $OLYWORK_TOKEN. (the old token stops working)
{{agentSnippet}}
Put this wherever the agent runs — a .env, a CI secret, or its config.
Members
Daily cap = how many calls + runs a member may make per day. -1 = unlimited.
Tools = which endpoints/CLIs a member may call or run. Local run = may run CLIs on their own machine (off = server only). The owner always has full access.
Email
Role
Today
Daily cap
Tools
Local run
↳{{m.client}}detected
runs as {{short(m.member)}} — inherits their full access
—
{{m.used_today}}
{{m.calls_30d}} calls in 30 days · last seen {{when(m.last_seen)}}
↳{{m.name}}agent
{{m.created_by?('owned by '+short(m.created_by)):'machine identity'}}
{{m.email}}
{{m.role}}
{{m.used_today}}
All
Tools & skills {{m.email}} may use/see — uncheck to withhold. All checked = full access (and new ones apply automatically).
No tools registered yet.
Projects {{m.email}} may use — all checked = every project (and new ones apply automatically). Tools with no project stay visible to everyone.
Tip: create a project to scope members to just part of the team's tools.
Add to this team
A member is a person who signs in. An agent is a machine identity with its own token — capped, scoped and logged as itself. Scope either with Tools and Projects above.
New agent
{{promoteHint}}
Projects (all checked = every project):
Cap -1 = unlimited. An agent can never be an owner, and can never sign in — its token is the only way to act as it.
Tools this member may use (all checked by default — uncheck to withhold):
No tools registered yet.
Invite sent to {{lastInvite.email}} ({{lastInvite.role}}). They can sign in and accept it code-free - or use this one-time code:
{{lastInvite.code}}
Pending invites
Email
Role
Invited by
Expires
{{inv.email}}
{{inv.role}}
{{short(inv.invited_by)}}
{{inv.expires_at?until(inv.expires_at):'never'}}
No pending invites.
Balance
{{money(billing.balance_micro)}}
Top-ups aren't configured on this deployment.
You were invited
by
{{billing.referral_offer.referrer_masked}}
to olywork
— add
{{money(billing.referral_offer.remaining_micro)}}
more
or more
and we'll add {{money(billing.referral_offer.referred_micro)}} to your
balance straight away. They get
{{money(billing.referral_offer.referrer_micro)}} after
{{billing.referral_offer.hold_days}} days.
Auto top-up is set up and will switch on as soon as a top-up saves your card.
Auto top-up switched itself off ({{billing.autotopup.disabled_reason}}). Once the balance runs out, calls will fail until it's funded.
On - we add {{money(billing.autotopup.amount_micro)}} whenever the balance drops below {{money(billing.autotopup.threshold_micro)}}. This month: {{money(billing.autotopup.month_spend_micro)}}.
{{autoOpen?'Cancel':'Edit'}}
Keep agents running without watching the balance. We charge your saved card only when it dips below your threshold.
Add $when the balance drops below $
Payment history
Loading…
No top-ups yet. Once you add funds, every payment shows up here with its invoice.
Invoice links are temporarily unavailable — the amounts above are correct. Try again shortly, or use Manage billing for the full archive.
Loading…
Projects
A project groups tools inside this team, so a member or agent can be scoped to just part of it. A tool with no project stays visible to everyone. Secrets stay team-level — one shared credential can back tools in several projects; scope who uses them via member access.
No projects yet — every tool is team-wide.
Project
Slug
Tools
{{p.name}}
{{p.slug}}
Tools in {{p.name}} — check to add, uncheck to make team-wide again. Checking a tool that lives in another project moves it here.
No tools registered yet.
Policy
Block calls to a host, a path, or a method. Leave a field empty to mean any. Applies to the proxy and to runs — and to everyone, including owners.
olywork blocks at three layers: the rules above (HTTP host/path/method, this team's policy), these per-tool argument patterns (from the skill's olywork.json or the olywork catalog — edit them there), and the OS sandbox around isolated local runs.
Tool
Blocked argument patterns
{{t.tool}}off
{{pat.pattern}}· {{pat.source}}
Daily spend limit
The most this team can spend per day on olywork's keys. Resets at 00:00 UTC. It's the
blast radius of a runaway agent — worth keeping even with auto top-up on, since a
balance that refills itself can't stop one.
USD/day · now {{money(capCfg.daily_cap_micro)}} (our default)
{{capErr}}
You can lower this freely. Raising it past {{money(capCfg.platform_ceiling_micro)}}/day needs a word with us — that's the ceiling we allow a team.
Per-customer limits
Cap or block one of your own customers by the tags your calls carry
(X-Olywork-Meta). Limits stack — a workspace ceiling and a
per-customer ceiling both apply, and a refusal names which one hit. They are
advisory: concurrent calls can overshoot slightly, and your balance is the
hard limit.
Calls & runs per member over the last {{usageDays}} days. Counts only - no request or response content is stored.
{{usage.totals.total}}
total events
{{usage.totals.call}}
API calls
{{usage.totals.local_run}}
local runs
{{usage.totals.server_run}}
server runs
By member
Member
API
Local
Server
Total
{{short(u.user_email)}}
{{u.call}}
{{u.local_run}}
{{u.server_run}}
{{u.total}}
No usage in this window.
Top tools
Tool
Events
{{t.name}}
{{t.total}}
Per day
Day
Events
{{d.day}}
{{d.total}}
By {{key}} X-Olywork-Meta
What each {{key}} spent, from the ledger. A call is credited in full to every
tag it carries, so these sections are different slices of the same money — never add
two of them together.
{{key}}
Calls
Spend
{{r.value}}
{{r.calls}}
{{money(r.charged_micro)}}
untagged
—
{{money(tagUsage[key].unattributed_micro)}}
Nothing tagged {{key}} in this window.
Loading…
Platform admin
Cross-tenant control (super-admin). Suspend locks members out; delete cascades.
olywork is ready with your agent. Copy any example below and send it to your agent.
also connect OAuth to unlock new agent capabilities
{{g.label}}
{{g.soon.length}} coming soon
Build on olywork
Optional, for two other kinds of user. Each is a skill file — paste the line into your coding agent, in your own repo, and it implements the rest.
Put your API in front of every olywork agent. Your agent reads the guide, writes the catalog entry for your endpoints and prices, and opens the PR.
Read {{proxy}}/vendor-listing.md and add our API to the
olywork catalog, then open a PR.
Give your users the catalog of capabilities without owning the keys — and bill each of your customers for what they used. Covers the call methods (HTTP, MCP, CLI), per-customer tagging, spend limits and invoicing.
Read {{proxy}}/integrate.md and integrate olywork into our
product, including per-customer usage tracking and billing.
Prefer the terminal? Manual CLI setup & sharing your team's keys →
Catalogued endpoints: SEO and backlinks, social and trends, people and company enrichment, ads. Find one by what it does, see its price, call it — no provider signup. Your team's $1.00 free credit covers hundreds of calls.
▸ Set up with your agent — paste & go
One line, token included — your agent reads llms.txt and does the rest: installs the CLI, signs in as you, and makes its first call.
{{buildAgentPrompt('agent', true)}}
▸ Or set it up manually
1 · Install the CLI
Installs the olywork command and points it at this server. Upgrade later with olywork update.
curl -fsSL {{proxy}}/install.sh | sh
2 · Sign in
Opens your browser — GitHub, Google, or an email code. Your first sign-in also registers you.
olywork login
3 · Call something — no key, nothing to set up
Search the catalog by what you need done, check the price, call it, and see exactly what it cost.
olywork catalog search "backlinks for a domain"olywork call tikhub.tiktok.user.profile --query uniqueId=tiktok
olywork balance # see exactly what it cost
Share your skills & API keys with the team — your .env keys and skill folders become tools every teammate's agent can call, without the key ever leaving the server.
▸ Set up with your agent — paste & go
One line, token included — your agent reads llms.txt, installs the CLI, signs in as you, and can register your local skills + keys as shared tools (read-only scan first, you approve).
{{buildAgentPrompt('agent', true)}}
▸ Or set it up manually
1 · Install the CLI
Installs the olywork command and points it at this server. Upgrade later with olywork update.
curl -fsSL {{proxy}}/install.sh | sh
2 · Sign in
Opens your browser — GitHub, Google, or an email code. Your first sign-in also registers you.
olywork login
3 · Upload your keys & skills
Two ways to give your agents power: share a whole skill, or register a single API endpoint. Preview with olywork scan first. Idempotent — re-run freely.
olywork upload # both .env + skills in this dirolywork upload env --select openai,stripe
olywork upload skills --dir~/.claude/skills--all# register skill from a specific path
▸ Then — let the team use it
Your team's own tools: a teammate pulls a shared skill and calls any registered API, with no keys on their machine. These are never metered — your team already pays for them.
4 · Use the team's shared tools
Browse the shared library, pull a skill, and call a tool — the credential stays on the server, never on your machine.
olywork skill ls
olywork skill install seo-blog-writer
olywork call https://api.stripe.com/v1/charges
Refer a friend
They get {{money(ref.terms.referred_micro)}} when they add
{{money(ref.terms.min_topup_micro)}}. You get {{money(ref.terms.referrer_micro)}},
{{ref.terms.hold_days}} days later.
Loading…
Create a team to unlock your link
Referral rewards are paid as credit into a
team you own, so you'll need one first.
Your link
Your reward lands in {{ref.credit_org.name}}.
{{ref.totals.signed_up}}
signed up
{{ref.totals.topped_up}}
topped up
{{money(ref.totals.earned_micro)}}
earned
{{money(ref.totals.pending_micro)}} on the way — rewards land
{{ref.terms.hold_days}} days after your friend adds funds.
You've hit the {{ref.cap.limit}}-referral limit
That's as far as the self-serve program goes.
If you're sending real volume, email support@olywork.com — we pay partners in cash.
Your referrals
Nobody yet. Share your link above.
Who
Signed up
Status
Reward
{{r.email || '—'}}
{{bhistDate(r.signed_up_at)}}
{{refStatus(r)}}
{{money(r.reward_micro)}}—
Tutorial
Four ways to learn olywork - pick one.
▤ CLI tutorial
The whole registry from your terminal - copy each command and follow along. {{tutSteps.length}} steps.
Dashboard tour
Everything you can do in this web UI, a screenshot per step. {{tourSteps.length}} steps.
▞ Import & shell
Turn the CLIs on your machine into team tools, then use them in a shell where they just work - plus the security sandbox. {{(tutData.importShell||[]).length}} steps.
▟ Team access control
Choose which tools each member may use, and whether they may run CLIs locally. {{(tutData.access||[]).length}} steps.
You bring your own {{tokenAsk.provider.auth_kind==='key'?'API key':'bot'}}, so it stays yours — olywork
holds it server-side and injects it on every call.
You'll pay on Stripe's secure page. The balance updates the moment the payment lands.
Connect {{capAsk.provider.display_name}}
What should your agent be allowed to do with this account?
Widening it later means going through the provider's consent screen again.
{{capAsk.provider.consent_notice}}
Calls on this connection are
metered from your team balance — {{capAsk.provider.display_name}} bills per use
(reads ~${{capAsk.provider.billed_rates.read_per_result_usd}}/result,
posts ${{capAsk.provider.billed_rates.write_per_call_usd}},
${{capAsk.provider.billed_rates.write_with_link_usd}} when the post links out).
Connecting your own developer app instead is never metered.
The {{resPick.label}} your agent uses by default.
It can still use another one per call — this just saves it guessing.
Asking the provider which {{resPick.plural}} you can use…
{{resPick.err}}
No {{resPick.plural}} found — this account may not have access to any.
{{r.label||r.id}}{{r.id}}
Add a skill
Pick a skill folder (or a folder of skills). olywork reads each SKILL.md and detects whether it's a recipe, a tool, or needs credentials - exactly like olywork upload skills - and shows you before anything is registered.
Analyzing…
{{detected.length}} skill(s) found:
{{skillSummary(s)}}
{{sec.name}}✓ from {{sec.source}} {{sec.ref}}needs {{sec.source}} {{sec.ref}}
An endpoint = an upstream base URL + one or more credential bindings (how olywork injects each key). Need a key? Close this and open ⚿ Secrets first.
Bindings - how each key is injected
{secret} becomes the credential - e.g. header Authorization: Bearer {secret}, or query api_key={secret}. Every binding applies on each call (multi-credential upstreams).
Optional. Team-wide is the default. A project only narrows things for members you have scoped to it.
Members run olywork run {{tForm.cli.bin||'<cli>'}} -- <args> — olywork injects the key into that run's environment only; it never lands on their machine.
Binding key - injected as an env var, per run
Deny list - matching runs are refused before the key is injected
Each row is a regex, matched against the whole command line AND each argument — block subcommands that execute arbitrary code ((^|\s)run(\s|$)) or flags that redirect the key (--publish-url\b).
No guardrails — any {{tForm.cli.bin||'CLI'}} invocation gets the key.
catalog
{{toolErr}}
Join with an invite code
Paste the one-time code an admin gave you. It must match your email ({{me}}). Invites addressed to you also appear automatically as a banner.
{{joinErr}}
You're invited 👋
{{pendingInvites.length===1 ? 'Accept to call the team\'s tools with' : 'You have '+pendingInvites.length+' pending invites — pick the teams to join and call their tools with'}} no API keys on your machine.
{{inviteErr}}
Welcome{{me?', '+me.split('@')[0]:''}} 👋
Create your team — it's where you keep API keys and skills so your teammates and their agents can call them without holding the keys. You can invite people and add secrets right after.
Which agent are you using?
Choose your agent for the best setup instructions.
{{welcomeAgent.plugin ? 'Your Bot reads that file and signs in with your team & token — then it can call every tool in the catalog.' : 'Your agent reads that file and signs in with your team & token — it installs the CLI and starts calling tools.'}}
One call to the proxy - your key is injected server-side. PATH is the {{copyTool.host}} path you'd normally call.
Examples - click to drop into the snippet
{{ex.method||'GET'}}{{ex.note||ex.path}}
Your token is included - paste and run.$OLYWORK_TOKEN is a placeholder - set it to your token.
Install “{{copyRecipe.name}}”
A recipe is know-how (a SKILL.md), not an API - you don't call it, you install it into .claude/skills/ so an agent can use it.
{{agentGuide==='admin'?'Sync your skills & secrets':'Use your team’s shared tools'}}
Paste this into your coding agent (Claude Code / Codex / Gemini). One line — the agent reads llms.txt and does the rest: installs the CLI, signs in as you, and makes its first call. No API keys land on your machine.
{{agentPromptText}}
List your API in this catalog
Sell an API? This is an instruction for your coding agent, not for you — paste it into Claude Code, Codex or any coding agent. The agent reads the hosted instructions, prepares the listing files, and opens a pull request on the olywork repo — with your contact email so we can arrange live verification.
Already on the team? Just send them the page link (⧉ Copy link). This invites someone new — after one click in the email they land on this exact page.
{{share.member.email}} is already a member — just send them the link, no invite needed.
Full access = they see and can use everything the team has registered. Uncheck to scope them to just {{detail.kind==='skill'?'this skill':'this tool'}} — they'll only see and call what you're sharing. Local CLI runs stay off either way.
{{share.err}}
{{viewRecipe.name}} · SKILL.md
{{viewRecipe.recipe}}
{{err}}
unsaved changes
Use “{{tryTool.name}}”
HTTPAPI callCLIrun on server
Enter the API path for {{tryTool.host}} (everything after the domain) and Send - it runs through the proxy with the key injected. You never send the key.
Examples - click to fill
{{ex.method||'GET'}}{{ex.note||ex.path}}
→ {{tryMethod}} {{tryTool.base_url}}/{{tryPath}}
Response {{tryStatus||'ERR'}} · {{tryMs}}ms · key injected by registry
{{tryResp}}
Runs {{(tryTool.cli&&tryTool.cli.bin)||tryTool.name}} on the registry server with the credential injected there - the key never reaches your machine. Same as olywork run --server {{tryTool.name}}.
⚡ {{epTryAccess.detail||'No key needed — served on olywork\'s key, billed to the team balance.'}}
🔑 Served with your team's own {{epTry.provider_display||epTry.provider}} credential — billed by the provider, not the team balance.
{{epTryAccess.detail||'Not callable from this team yet.'}}
1 · Set up with your agent
One line — the agent reads llms.txt, installs the CLI and signs in as you. Token & team are baked in.
{{epTrySetupLine}}
2 · Ask your agent to use this
Paste this next — the agent calls the endpoint through olywork, no key on its machine.
{{epTryAgentUse}}
1 · Install the CLI & sign in
curl -fsSL {{proxy}}/install.sh | sh
olywork login
2 · See its params & price
olywork catalog get {{epTry.id}}
3 · Call it — the key is injected server-side
{{epTryCliCall}}
One endpoint, one connection. olywork injects the credential server-side and relays the response verbatim.
{{epTryCurl}}
$OLYWORK_TOKEN is a placeholder — set it to your API token (copy it on Getting started).
{{epTryAccess.missing_message || (mkOauth(epTry.provider) ? 'Can\'t run this here yet — connect '+(epTry.provider_display||epTry.provider)+' first, then Run.' : 'This endpoint needs a key. Use the AI Agent / CLI / API tab, or bring your own.')}}
No parameters — just run it.
Result
{{epTryStatus}}
· {{epTryMs}}ms · charged {{money(epTryCost)}} (free — provider charged 0 ⓘ)
· logged in Activity like any call
