Let Claude Code
log in to websites
Claude Code can drive a browser, but it stops at every login page. The usual fixes are bad: paste your password into the chat, or sign in yourself each time.
Why not just give it the password?
A password in the agent’s context can leak, end up in a log, or be typed into a fake website by a prompt-injected page. The agent does not need the secret. It needs the result.
How it works with Keyflap
- You type a request in Claude Code, for example
Sign me in to GitHub.
- A Claude Code hook sends your exact words to Keyflap. The AI model cannot change these words.
- Claude Code opens the site in a browser that Keyflap controls. The browser tells Keyflap the real address of the page, so a fake site matches no credential.
- Your phone shows your words, the real website and the agent’s name. You approve with Face ID, your fingerprint or your device PIN.
- A separate part of Keyflap, the signer, checks your approval. Then it uses the passkey or types the password and code into the page.
- Claude Code gets
signed in
ordenied
. Never the secret.
If something is wrong or not clear, Keyflap denies the sign-in. An error is a denial. A timeout is a denial. If you did not type a request, Keyflap denies the sign-in and does not ask you.
Set it up
Paste this into Claude Code on the computer where Keyflap should run:
Install Keyflap for me. Follow https://github.com/johnpippett/keyflap/blob/main/docs/INSTALL_FOR_AGENTS.md, then give me the one command to run myself.
Claude Code checks your computer and gives you one command. You run it yourself, on purpose: an agent must never set up its own guardrails. You need a Mac with Apple silicon or a Linux computer, your phone, and Tailscale on both (or your own HTTPS address with a real certificate that your phone can reach). The full steps are in the Claude Code guide.
What it does not do
- It does not solve CAPTCHAs. When a site shows one, you solve it in a live view on your phone.
- It does not control what the agent does after it signs in.
- Claude Code can start turns on its own: scheduled tasks, background subagents reporting back and messages from another session. These can look like your words, so do not use them in sessions connected to Keyflap.