diff --git a/src/atomdb/auth/BUILD b/src/atomdb/auth/BUILD
index 95bf0e9f..77634c6b 100644
--- a/src/atomdb/auth/BUILD
+++ b/src/atomdb/auth/BUILD
@@ -7,6 +7,8 @@ cc_library(
     includes = ["."],
     deps = [
         ":authorization_manifest",
+        ":authorization_types",
+        ":keychain",
         ":mongodb_authorization_persistence",
     ],
 )
@@ -60,3 +62,10 @@ cc_library(
         "//commons/atoms:atoms_lib",
     ],
 )
+
+cc_library(
+    name = "keychain",
+    srcs = ["Keychain.cc"],
+    hdrs = ["Keychain.h"],
+    includes = ["."],
+)
diff --git a/src/atomdb/auth/Keychain.cc b/src/atomdb/auth/Keychain.cc
new file mode 100644
index 00000000..896338fd
--- /dev/null
+++ b/src/atomdb/auth/Keychain.cc
@@ -0,0 +1,20 @@
+#include "Keychain.h"
+
+using namespace std;
+using namespace atomdb;
+
+// -------------------------------------------------------------------------------------------------
+// Constructor
+
+Keychain::Keychain(const map<Keychain::AtomDB_UID, Keychain::PublicKey>& keys) { this->keys_ = keys; }
+
+// -------------------------------------------------------------------------------------------------
+// Public methods
+
+Keychain::PublicKey Keychain::get_public_key(const Keychain::AtomDB_UID& uid) const {
+    auto it = this->keys_.find(uid);
+    if (it != this->keys_.end()) {
+        return it->second;
+    }
+    return "";
+}
diff --git a/src/atomdb/auth/Keychain.h b/src/atomdb/auth/Keychain.h
new file mode 100644
index 00000000..88496cc5
--- /dev/null
+++ b/src/atomdb/auth/Keychain.h
@@ -0,0 +1,40 @@
+#pragma once
+
+#include <map>
+#include <string>
+
+using namespace std;
+
+namespace atomdb {
+
+/**
+ * @brief Caller credentials: one public key per AtomDB UID.
+ *
+ * Holds the map `uid -> public_key` that identifies the caller to each
+ * AtomDB. `get_public_key(uid)` returns the key for that database, or
+ * an empty string if the UID is absent or stored as empty.
+ */
+class Keychain {
+   public:
+    using AtomDB_UID = string;
+    using PublicKey = string;
+
+    explicit Keychain(const map<AtomDB_UID, PublicKey>& keys);
+    ~Keychain() = default;
+
+    /**
+     * @brief Returns the public key registered for `uid`.
+     *
+     * Empty string means no usable key: the UID is missing or its stored
+     * value is empty.
+     *
+     * @param uid AtomDB UID to look up.
+     * @return The stored public key, or empty string.
+     */
+    PublicKey get_public_key(const AtomDB_UID& uid) const;
+
+   private:
+    map<AtomDB_UID, PublicKey> keys_;
+};
+
+}  // namespace atomdb
diff --git a/src/tests/cpp/BUILD b/src/tests/cpp/BUILD
index 7df8bd09..f5e99149 100644
--- a/src/tests/cpp/BUILD
+++ b/src/tests/cpp/BUILD
@@ -899,6 +899,21 @@ cc_test(
     ],
 )
 
+cc_test(
+    name = "keychain_test",
+    size = "small",
+    srcs = ["keychain_test.cc"],
+    copts = [
+        "-Iexternal/gtest/googletest/include",
+        "-Iexternal/gtest/googletest",
+    ],
+    linkstatic = 1,
+    deps = [
+        "//atomdb/auth:keychain",
+        "@com_github_google_googletest//:gtest_main",
+    ],
+)
+
 cc_test(
     name = "authorization_test",
     size = "small",
diff --git a/src/tests/cpp/keychain_test.cc b/src/tests/cpp/keychain_test.cc
new file mode 100644
index 00000000..cec2402c
--- /dev/null
+++ b/src/tests/cpp/keychain_test.cc
@@ -0,0 +1,29 @@
+#include "Keychain.h"
+
+#include <gtest/gtest.h>
+
+#include <map>
+#include <string>
+
+using namespace atomdb;
+using namespace std;
+
+TEST(KeychainTest, GetPublicKeyReturnsEmpty) {
+    Keychain empty_keychain({});
+    EXPECT_EQ(empty_keychain.get_public_key("blah"), "");
+    EXPECT_EQ(empty_keychain.get_public_key(""), "");
+
+    Keychain keychain(map<string, string>{{"uid1", "key1"}});
+    EXPECT_EQ(keychain.get_public_key("uid2"), "");
+    EXPECT_EQ(keychain.get_public_key("uid"), "");
+    EXPECT_EQ(keychain.get_public_key(""), "");
+
+    Keychain empty_stored_key(map<string, string>{{"uid", ""}});
+    EXPECT_EQ(empty_stored_key.get_public_key("uid"), "");
+}
+
+TEST(KeychainTest, GetPublicKeyReturnsStoredKey) {
+    Keychain keychain(map<string, string>{{"uid1", "key1"}, {"uid2", "key2"}});
+    EXPECT_EQ(keychain.get_public_key("uid1"), "key1");
+    EXPECT_EQ(keychain.get_public_key("uid2"), "key2");
+}