The Mac key manager for AI. Your keys stay encrypted on your Mac, and AI agents use them only through Ask Key:
- Find keys: agents look up what they need in Ask Key's catalog, so you stop pointing the way.
- Your rules: everyday keys pass, sensitive ones wait for your approval, and some stay hidden.
- Locked down: a key goes only to the program that needs it; the agent never sees the value.
Download for Mac (free, notarized, Apple silicon, macOS 14 or later) · Website
Ask Key has no backup or recovery yet, so keep the originals of your credentials somewhere else.
Coding agents need real secrets to deploy code, call APIs or log in to servers. The usual shortcuts are pasting a key into a chat, writing it into a prompt or leaving it in a .env file. Each of those hands plaintext to every tool, transcript and log that can read it, and you rarely see which agent used what.
Ask Key takes the secret out of that path. The agent never holds the stored value. It asks, you decide, and the value goes only to the program that needs it.
-
Download AskKey.dmg and AskKey.dmg.sha256 from the latest release.
-
In the download directory, verify the checksum before opening the DMG:
shasum -a 256 -c AskKey.dmg.sha256
Continue only if the check reports
OK. -
Open the DMG and drag
Ask Key.appinto Applications. It must stay at exactly/Applications/Ask Key.app, under that name, or agents cannot connect. -
Launch Ask Key and follow the three steps below.
To upgrade or remove it later, see Upgrade and Uninstall.
The welcome page walks you through the same steps.
- Store a credential. Choose New Credential, or Import from File… to bring in a
.envfile. New credentials default to Ask every time. - Connect your Agent. Open the Agent access page and choose Connect… next to Claude Code, Codex, Cursor or Grok CLI. See Supported clients.
- Try it once. Send your Agent the sample prompt from Agent access, for example "Use Staging API from Ask Key to run a command that checks its variables are set, without printing their values". Ask Key shows an approval prompt; choose Allow once. The Agent sees only the command's output, and the use appears in Access records. In your projects, ask for real commands such as
./deploy.shthe same way.
Ask Key itself is a macOS app. Community contributors maintain third-party Windows ports in their own repositories:
- A1mAssist/AskKey: C# and WinUI
- WENGENG-boop/AskKey-Windows: Rust and Tauri
Ask Key stores text credentials (API keys, tokens, passwords) and files (SSH keys, .p8, PEM, service-account JSON). One credential can have several parts, each mapped to an environment variable name. You add credentials by hand or import a .env file in the app.
flowchart LR
A[Agent] --> H["askkey helper"]
H --> B["Broker in the app"]
B --> P{"Your approval"}
P -->|approved| T["Target process (environment)<br/>or short-lived private file"]
P -->|denied| X["Nothing delivered"]
An agent first reads a catalog of credential names, usage instructions and variable mappings. The catalog never contains values. When the agent needs a credential, it runs its command through the helper, and the Broker inside the app decides whether to ask you. After approval, text parts become environment variables of the target process, and file parts are written to a random file in a private directory that is removed after a short time. The agent gets the target's output (through the helper) or just its exit status (through MCP), never the stored value.
askkey run --wait-for-approval \
--credential "Staging API" \
--operation-id deploy-001 \
--caller-name "Codex" --caller-purpose "Deploy staging" \
-- ./deploy.shThe helper ships inside the app bundle at Contents/Helpers/askkey. The target gets only the selected credentials, under the variable names set on each part, plus a filtered copy of the inherited environment.
Each credential has one permission:
| Permission | Effect on agents |
|---|---|
| Allow | Agents can use it without a prompt. Delivery still goes through the Broker. |
| Ask every time (default) | Every use waits for your approval. |
| Hidden | Not in the agent catalog; agents cannot request it. |
When you approve a read, you choose Allow Once or a timed allowance: a number of minutes during which that credential can be read without asking again, until it ends or you revoke it. For a grouped credential, you can also allow the eligible credentials listed in Details together. Later additions are excluded, and the whole allowance ends at the earliest member expiry if that is sooner. Active allowances appear at the top of the library with remaining time and revocation actions; Revoke Group Allowance ends the whole grant. Pending requests expire after five minutes.
In Settings, End Timed Allow on Lock is off by default and requires system authentication to turn on or off. Once enabled in this process, screen lock, sleep or user switch ends single and group timed allowances and unconsumed timed approvals, and cancels prepared runs containing a timed credential. New timed grants are refused while locked, asleep or switched out, including when the screen state is unknown. See SECURITY.md for the adoption and sleep limitations.
Agents can also write: create, modify or delete a credential, set its usage instructions and group, or move credentials and create, rename or delete groups in one batch. Every write needs your approval for that operation (a batch is approved once), the approval is tied to the exact content you were shown, and it cannot be reused for another change. Permanent deletion stays in the app.
Claude Code, Codex, Cursor and Grok CLI. Open the app's Agent access page, check a client, then confirm. For each client, setup:
- adds Ask Key as an MCP server in the user-level configuration, keeping a private backup and your other settings;
- installs a discovery hook that reminds the agent to look up the catalog before common direct SSH commands;
- verifies the configuration, the bundled helper and the Broker before it reports the client as connected.
Setup runs only when you ask for it, and writing a client's configuration needs system authentication. Discovery hooks are reminders, not authorization.
Any client that supports standard MCP stdio servers can connect to Ask Key by defining a server with:
command:/Applications/Ask Key.app/Contents/Helpers/askkeyargs:["mcp"]
Manual setup does not include automatic discovery reminders before SSH commands or connection verification in the app. Broker permissions, approval prompts, and credential delivery protections still apply.
The full policy, including how to report a vulnerability privately, is in SECURITY.md. In short:
- Credentials are encrypted locally. Responses from Ask Key's management, MCP and helper interfaces do not contain stored plaintext.
- Revealing or copying a stored value in the app requires fresh system authentication.
- Revoking, expiring or pausing stops deliveries that have not started and cleans up temporary files.
What Ask Key does not guarantee:
- An approved target can print, copy or forward what it receives.
- Caller names and purposes are declared by the agent. They help you read a request; they are not verified identity.
- Another process running as the same macOS user may be able to read material after an approved delivery. Hidden keeps a credential out of the agent catalog but does not defend against that.
- A timed allowance covers one credential or the explicitly approved group snapshot for the whole local user, not one agent client. Later group additions are excluded; writes still need separate approval.
Before updating to 0.5.0, quit Ask Key. Download and verify the new DMG as described in Install, replace /Applications/Ask Key.app with the app from the new DMG, then open Ask Key from Applications.
Upgrading from 0.4.0 does not migrate the library or require a library backup for this upgrade. Credentials, permissions and valid Agent access settings are kept without a Resume step. End Timed Allow on Lock starts off. Ask Key has no built-in backup or recovery; keep the originals of your credentials elsewhere as well.
Downgrading to 0.4.0 with the setting off changes nothing. Turn it off before downgrading. With it on, 0.4.0 cannot verify the saved Agent access settings and pauses Agent access; choosing Resume Agent Access there and authenticating restores all Agent access settings to defaults. Upgrading again before Resume preserves the saved settings.
For upgrades from 0.3.2 or earlier, also read the migration and compatibility notes for the intervening versions in CHANGELOG.md.
Releases after 0.5.0 can update themselves. On the second launch, Ask Key asks whether to check for updates automatically, once a day. You can change that later with Check for Updates Automatically in Settings → General, and check at any time with Check for Updates… there or in the menu bar icon's right-click menu. Nothing is installed until you confirm it. Installing relaunches Ask Key once no request is waiting or running; after the relaunch, Ask Key is locked again and timed allowances have ended. Connected agents need no setup change: the install path, the helper and the Broker protocol stay the same, and running helpers keep working. Tools added in a new version appear after the agent restarts its MCP server. Only the official copy at /Applications/Ask Key.app checks for updates; development and test builds never do. Sparkle's update windows follow the macOS language rather than Ask Key's language setting.
Update checks are Ask Key's only outbound network requests. A check requests https://askkey.sudohg.com/appcast.xml through Cloudflare, which redirects to the appcast attached to the latest GitHub Release; an update downloads from GitHub. Both see your IP address. Requests carry the User-Agent Ask Key/<version> Sparkle/<version> and the standard headers macOS adds, such as your preferred languages; no system profile is sent. The appcast and the update must carry valid signatures from Ask Key's EdDSA key before anything is installed. With automatic checks off, Ask Key makes no request until you choose Check for Updates…. The exact requests are recorded in ADR 0011.
Version 0.5.0 and earlier have no updater: watch GitHub Releases and update as described above.
Quit Ask Key and delete /Applications/Ask Key.app. For each connected client, remove only the Ask Key entries and owned files listed in What setup writes, including MCP configuration, discovery Hooks and Ask Key-specific Hook trust settings (for example, for Claude Code, run claude mcp remove askkey --scope user and remove Ask Key handlers from ~/.claude/settings.json). Preserve unrelated client settings and Hooks. There is no in-app way to disconnect a client.
You can optionally erase the local credential library as well. This permanently destroys all stored credentials and cannot be undone; Ask Key has no backup or recovery. To do so, delete ~/Library/Application Support/AskKey and use Keychain Access to delete the keychain item with service com.sudohg.askkey.vault.
Requirements: macOS 14 or later, and Xcode with a Swift 6 toolchain.
swift build
swift test
make runmake run builds a Debug app and starts it with separate development data, key material and socket, so it never touches an installed copy of Ask Key. Use synthetic credentials when trying it out. See CONTRIBUTING.md for the full requirements, UI test flow and pull request checks.
The documentation index lists every guide and architecture decision. To find your way around the code, start with the architecture guide; testing.md explains the local checks and the desktop flows that run in CI.
MIT. See LICENSE and NOTICE. Ask Key started as a fork of Lokalite by Ruben González Alonso; the product and most of the code have since been rewritten. The Chinese product name is 请旨.