# Aembit use cases

> Find the right starting point for your Aembit implementation

Aembit replaces static secrets with identity-based access. It secures two kinds of non-human identity, AI agents and workloads, so find your starting point below based on what you’re securing.

> **New to Aembit?**
>
> Start with **CI/CD Pipelines**. It’s the fastest path to seeing Aembit in action, with no agent deployment required.

## AI

Aembit secures AI access in both directions: AI agents reaching into your systems (directly or through MCP servers), and your own applications reaching out to LLM APIs. All three use cases share the same identity-first model.

[Securing AI agent access to your resources](/get-started/use-cases/ai-agents)Secure Claude Desktop, Gemini CLI, and other MCP clients with user-level access control and full audit trails.

→

[Securing MCP server access](/get-started/use-cases/mcp-server-access)Front your MCP servers with the Identity Gateway so AI agents hold no credentials and every request is audited per user.

→

[Securing your applications' access to LLM APIs](/get-started/use-cases/ai-llm-access)Eliminate embedded API keys for OpenAI, Anthropic, Azure OpenAI, and other LLM APIs. Control costs and prevent denial of wallet attacks.

→

## Workloads

Applications, services, pipelines, and databases all need credentials to reach the resources they depend on. Aembit issues those credentials just-in-time from verified identity, with no static secrets to store or leak.

### Applications and services

[Credential Management](/get-started/use-cases/credential-management)Unify access to AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault through a single identity-based policy layer.

→

[Microservices Security](/get-started/use-cases/microservices-security)Replace shared service accounts with per-workload identity using SPIFFE JWT-SVID or OIDC tokens in your service mesh.

→

### CI/CD and automation

[CI/CD Pipelines](/get-started/use-cases/ci-cd)Eliminate hardcoded secrets in GitHub Actions, GitLab CI, and Jenkins. No agent required; it uses your platform's OIDC tokens.

→

### Data and analytics

[Database Access](/get-started/use-cases/database-access)Replace static database passwords with short-lived, identity-based credentials. No changes required on the database side.

→

### Infrastructure and platform

[Multicloud Environments](/get-started/use-cases/multicloud)Authenticate workloads in AWS, Azure, and GCP using their native identity, with unified policies across all environments.

→

[Third-Party Access](/get-started/use-cases/third-party-access)Securely connect to external services like GitLab or Snowflake with automatic credential rotation.

→

***

## Quick reference

| If you’re…                                  | Start with                                                              | Complexity  |
| ------------------------------------------- | ----------------------------------------------------------------------- | ----------- |
| Securing AI assistants and MCP clients      | [AI agent access](/get-started/use-cases/ai-agents)                     | Moderate    |
| Centralizing and auditing MCP server access | [MCP server access](/get-started/use-cases/mcp-server-access)           | Moderate    |
| Protecting LLM API access                   | [LLM API access](/get-started/use-cases/ai-llm-access)                  | Quick start |
| Securing CI/CD pipelines                    | [CI/CD Pipelines](/get-started/use-cases/ci-cd)                         | Quick start |
| Consolidating vault access                  | [Credential Management](/get-started/use-cases/credential-management)   | Moderate    |
| Securing database access                    | [Database Access](/get-started/use-cases/database-access)               | Moderate    |
| Running Kubernetes microservices            | [Microservices Security](/get-started/use-cases/microservices-security) | Moderate    |
| Managing multiple cloud providers           | [Multicloud Environments](/get-started/use-cases/multicloud)            | Advanced    |
| Connecting to external SaaS APIs            | [Third-Party Access](/get-started/use-cases/third-party-access)         | Moderate    |

***

## See also

* [How Aembit works](/get-started/how-aembit-works) - Architecture and deployment model
* [Quickstart](/get-started/quickstart/) - Get started in minutes
* [Security posture](/get-started/security-posture/) - Security architecture and compliance