Keyflap

Your agent signs in.
It never holds the keys.

  1. Your agent hits a login
  2. You swipe to approve on your phone
  3. It's signed in. No password shared.
Install Keyflap

What happens when your agent hits a login.

  1. You ask your agent

    Your own message is the permission slip. No message from you, no sign-in.

  2. Keyflap checks the site

    The browser, not the agent, says which site this really is. Fakes get nothing.

  3. Your phone asks you

    It shows what you asked for and where. Swipe to approve, then Face ID.

  4. Keyflap signs in

    Keyflap’s signer does the login. The agent never touches the key.

  5. Your agent carries on

    All it gets back is signed in.

The agent gets the valet key. Never the ring.

Your passkeys stay in the signer, a separate process behind its own authenticated socket. Passwords come from the signer or your password manager, and only after you approve. Your agent asks, Keyflap checks the site and your words, you approve, and Keyflap signs in. The key goes back on its hook.

A look-alike site doesn't get the wrong key. It gets an empty hook.

Drag a tag. It swings. It doesn't come off.

Try it.

Your agent checks your computer and explains each step. You run the one command.

You need a Mac with Apple silicon or a Linux computer, your phone, and Tailscale on both.

1Paste this into your agent

Install Keyflap for me. Follow https://github.com/johnpippett/keyflap/blob/main/docs/INSTALL_FOR_AGENTS.md, then give me the one command to run myself.

2Or run it yourself
$ curl -fsSL https://github.com/johnpippett/keyflap/releases/latest/download/install-keyflap.sh | sudo bash

Only you run it: you type your admin password, scan the pairing code with your phone, connect your password manager and approve the first sign-in. Your agent can’t, on purpose: it must never set up its own guardrails.

Step-by-step instead View on GitHub

Early alpha, not yet audited. Start with test accounts.

Try to phish it.

Keyflap has a passkey for github.com. Pick a site and see if it gets in.

https://
Examples

Ten rules that don't bend.

Each one is tested. Any doubt means no.

  1. 01

    The agent never sees a secret.

  2. 02

    The browser names the site, not the agent.

  3. 03

    A key only fits its own site.

  4. 04

    No request from you, no sign-in.

  5. 05

    Your phone shows your words, never the agent's.

  6. 06

    Nothing signs in without your OK.

  7. 07

    The agent can't reach into the browser.

  8. 08

    Passwords are scrubbed from everything it reads.

  9. 09

    Only Keyflap can talk to the vault.

  10. 10

    Every step is logged, tamper-evident.

Works with
PasskeysPasswords and one-time codes1PasswordProton PassApple Passwords importFace ID on your phonePer-site rulesSaved loginsAudit log
Today
Claude Code, Codex CLI and Hermes Agent, on Mac and Linux. Early alpha, not yet audited.
Next
More agents, more systems.
Read the architecture and threat model