Keyfit
Your AI agents and cloud CLIs use the accounts of the project you are in, checked before they start.
Install • Website • Documentation • Security • Changelog
Real Keyfit and Claude Code with two made-up clients, whose AWS and Linear accounts are stand-ins (scripts/demo records it).
Keyfit is for multiple accounts on one Mac: one per client, or work and personal. Each project can have its own Claude Code and Codex login, AWS profile, GitHub account and so on. After a one-time keyfit setup, you keep typing claude, codex, aws, gh and the rest as usual. Keyfit works out which project the current folder belongs to and checks that project's accounts with the services themselves. If everything matches, the tool starts with only that project's credentials. If a check fails, the tool does not start, and you see the command that fixes it:
$ cd ~/code/acme-api && claude
keyfit: claude not started, acme-api needs attention
✘ aws acme-dev → …4321 SSO session expired
→ aws sso login --sso-session acme
(bypass once: KEYFIT_DISABLE=1 claude …)
Folders you have not registered work exactly as before.
Most tools that switch credentials per folder assume the switch worked. Keyfit asks each service who you are signed in as, and stops the tool if the answer is wrong.
Who it's for
You use Claude Code, Codex, OpenCode, Copilot CLI or Gemini CLI for several clients or companies, and each one has its own AWS account, Linear workspace, GitHub login, Vercel team, Supabase organization, Cloudflare account, Convex team, Google account (work or personal), Google Cloud project and Firebase project, Claude organization or OpenCode sign-ins. You want an agent working in one client's repository never to act with another client's credentials, and you don't want to remember to switch anything.
If you work with a single set of accounts, you don't need Keyfit.
What is checked
Agents get, and check, all of the project's accounts:
| Agent | Command | Keyfit confirms |
|---|
| Claude Code | claude | the Claude organization |
| Codex | codex | a ChatGPT login, without an API key |
| OpenCode | opencode | OpenCode's sign-ins |
| Copilot CLI | copilot | the GitHub account it runs as |
| Gemini CLI | gemini | the Google account it is signed in to |
Since 18 June 2026, Gemini CLI no longer serves Google AI Pro, Ultra or free personal accounts: Google moved them to Antigravity CLI, which Keyfit doesn't cover. Gemini CLI still works with a Gemini Code Assist licence or an API key.
CLIs get only their own account:
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
