Authsia

Runtime security · macOS

Runtime security for AI coding agents

Agents can run commands. They don’t inherit your secrets until you say so.

Download for Mac See how grants work

Local Keychain. Scoped JIT. Revoke anytime.

Access Center

Agent secret request

Active grants

1

Items accessed

4

Top caller

demo-agent

Caller
demo-agent
Wants
DEMO_API_KEY +3
Scope
exec · this workspace
Workspace
~/Projects/acme-api
Status
Waiting for approval Approved · 14:37 Injected · 09:12 Revoked · access ended

Injected into child process only

Parent shell stays clean. Masked on mediated output.

The gap

Agents inherit your authority

A coding agent runs with your permissions. It can launch tools, touch cloud CLIs, and act on your machine. A vault that only protects secrets at rest does not decide whether that agent should receive a credential at runtime.

Authsia closes that gap on your Mac — locally, with a human in the loop.

Access Center

Every secret use is a grant

Access Center shows who is asking, what scope they want, and how long access lasts. Approve, deny, or revoke without changing project files.

Caller

Know who is asking

Agent and tooling identity stays visible for the life of the grant.

Scope · TTL

Bound the blast radius

Time-boxed, workspace-aware access — not a standing secret in the parent shell.

Revoke

Cut it off anytime

End the grant immediately when the task is done or something feels wrong.

Last mile

Secrets leave the vault at the last mile

Authsia resolves commit-safe refs and injects credentials into approved child processes. The agent-visible parent shell stays clean, and known secret values can be masked on mediated output.

Local audit history records what was released, who approved it, and what ran under that grant — without sending telemetry away. 

# run with scoped secrets
authsia workspace run -- npm test

# review what was released
authsia audit list

Get started

Install on your Mac

Launch Authsia once, enable CLI Access, then let workspace commands carry the security boundary for terminals and agents.

Download for Mac Install guide 
# app + CLI
brew install --cask james-liang-cs/authsia/authsia

# first check
authsia status