Authsia secures
agent access.

Secrets move only when you approve.

Scroll

The runtime boundary

The agent asks. You decide. It runs. Scoped. Then you cut it off.

Authsia binds access to the agent, the workspace, the capability, and time.

demo-agent · acme-api Requesting access Approved Injected Revoked


              $ authsia workspace run -- npm test

              
                Waiting for scoped approval…
                Grant live · child process only
                Injected into child process only
                Access ended

Access Center

Local only

Agent secret request

Approve scoped access Access granted Running under grant Grant revoked

Active grants

Items accessed

Top caller

demo-agent

Caller

demo-agent

Wants

DEMO_API_KEY +3

Scope

exec · this workspace

Workspace

~/Projects/acme-api

Waiting for approval Approved · 14:37 Injected · 09:12 Revoked · access ended

Injected into child process only

Parent shell stays clean. Masked on mediated output.

The gap

Agents inherit your authority.

A coding agent runs with your permissions. It can launch tools, touch cloud CLIs, and act on your machine. A vault that only protects secrets at rest does not decide whether that agent should receive a credential at runtime.

Authsia closes that gap on your Mac — locally, with a human in the loop.

Last mile

Secrets leave the vault at the last mile.

Commit-safe refs resolve into the child process you approved. The parent shell stays clean, known values can be masked on mediated output, and local audit records what ran — without sending telemetry away.

Terminal

Workspace

# run with scoped secrets
authsia workspace run -- npm test

# review what was released
authsia audit list

Run agents. Keep control.

Launch Authsia once, enable CLI Access, then let workspace commands carry the security boundary for terminals and agents.

Download Authsia for Mac Install guide

brew install --cask james-liang-cs/authsia/authsia