Keyflap

---

Keyflap signs AI agents into websites for you. It uses your passkeys, your passwords and your one-time codes. The agent does not get these secrets. The agent gets only one of two results: signed in or denied.

Each sign-in starts with a request that you typed. Before Keyflap signs in, your phone shows the request and the real website. You approve with Face ID or your fingerprint.

[!WARNING] Keyflap is early alpha software. It uses real credentials on real accounts. Nobody outside the project has audited it, and it has no warranty. Use test accounts first. Do not connect an account that you cannot lose. Read SECURITY.md before you use it.

The problem

An AI agent that uses a browser must sign in to do useful work. Usually you have two bad options:

• Give the agent your password. The agent can then leak it, log it or use it on a fake website.
• Sign in yourself each time. This stops the agent until you return.

Keyflap gives a third option. The agent asks, you approve, and Keyflap does the sign-in. The secret stays with Keyflap.

How it works

1. You make a request. You tell your agent: "Sign me in to GitHub." A hook in the agent app sends your exact words to Keyflap. The AI model cannot change these words.
2. The agent goes to the website. The agent uses a browser that Keyflap controls.
3. Keyflap finds the real website. The browser tells Keyflap the address of the page. The agent and the page cannot change this address. A fake website gets no credential, because no credential matches its address.
4. Your phone asks you. The approval card shows your words, the real website and the name of the agent. It never shows text from the agent or from the page.
5. You approve. You use Face ID, your fingerprint or your device PIN.
6. Keyflap signs in. A separate part of Keyflap, the signer, checks your approval. Then it uses the passkey or types the password and code into the page.
7. The agent gets the result. The agent gets "signed in" or "denied". It does not get the secret.

  You ──"sign me in"──▶ Agent ──▶ Keyflap ──▶ Website
                                     │
                          Your phone: "Approve?"
                                     │  Face ID
                                     ▼
                     Signer checks your approval, then signs in
                                     │
  Agent ◀────────── "signed in" or "denied" (no secret) ────┘

If something is wrong or not clear, Keyflap denies the sign-in. An error is a denial. A timeout is a denial. If you did not make a request, Keyflap denies the sign-in and does not ask you.

What you get

Passkeys	Keyflap adds a passkey to an account and signs in with it. Your other sign-in methods do not change.
Passwords and one-time codes	Keyflap keeps them in the signer. It types them into the page itself, also the 6-digit code.
Password managers	Use your logins from Proton Pass or 1Password. Keyflap reads a login only after you approve.
Phone approval	A web page on your phone. No app store is necessary. You swipe a card to approve or deny, and each approval needs Face ID, a fingerprint or a PIN.
Rules for each website	Deny a website, always ask, ask with Face ID each time, or allow for a set time (24 hours at most) after one approval. Banks, payments, shopping, email, sign-in providers, code hosting, password managers and government websites always need a new approval with Face ID, a fingerprint or a PIN.
Saved sessions	Keyflap keeps the agent signed in after a restart, and encrypts this data. For high-risk websites, it does this only if you allow it.
Human checks	Keyflap does not solve CAPTCHAs. When a website shows one, you solve it in a live view on your phone.
Audit log	Keyflap records each request and each decision in a hash-chained log. keyflap audit verify finds changes to the log.

Supported agents

• Claude Code
• Codex CLI
• Hermes Agent (gateway direct messages)

Other agents need a hook that sends your exact words to Keyflap.

Get started

Install it with your agent. Paste this into your agent, on the computer where Keyflap should run:

Install Keyflap for me. Follow https://github.com/johnpippett/keyflap/blob/main/docs/INSTALL_FOR_AGENTS.md, then give me the one command to run myself.

The agent checks your computer and explains each step. Then it gives you one command, and you run that command yourself. The agent cannot do it for you, on purpose: it must never set up its own guardrails.

Or run the command yourself. It works on a Mac with Apple silicon and on Linux. First set up Tailscale on this computer and on your phone, in the same tailnet, with MagicDNS and HTTPS certificates turned on. On a Mac, use the standalone app from tailscale.com/download: the App Store app does not work with Keyflap. Then run this from your own account, the one your agents run as:

curl -fsSL https://github.com/johnpippett/keyflap/releases/latest/download/install-keyflap.sh | sudo bash

The command asks for your admin password. It downloads Keyflap and checks the download against fingerprints in its own script. Then it installs Keyflap as separate system users, so an agent that runs as you cannot read Keyflap's keys, memory or browser. A guided setup follows in the same window. You scan a code with your phone, pick your agent and connect your password manager. Later, sudo keyflap opens the management console, and the same command upgrades Keyflap. To install step by step instead, read Getting started.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗