Innkeeper
Get StartedDownload
  • +
  • +

Any agent · Any site

Agent authentication, made easy.

When your agent needs to log in, you sign in on your iPhone. The session stays on your phone.

macOS 26 or laterDownload for MaciPhone, on the App StoreGet the App
Claude app
Innkeeper

01Websites

Sign in to websites from your phone

When an agent needs a website, Innkeeper opens it on your iPhone. You sign in the way you normally would, and the session is saved on the phone.

  • ArgoCD's own sign-in page, open in the phone's browser
  • Jira's own sign-in page, open in the phone's browser
  • Microsoft's own sign-in page, open in the phone's browser
  • X's own sign-in page, open in the phone's browser
  • Stripe's own sign-in page, open in the phone's browser
  • Any siteIf you can sign in to it in a browser, it works.
  • Expiry datesEach session shows when it runs out.
  • Stays on your phoneThe agent can make requests with the session but can’t read it.
02Sign-ins
GoogleAn agent may
Read mail
Send mail
Organize mail
Calendar
Drive files
May be sent togmail.googleapis.com
  • GoogleSigned in
  • GitHubSigned in
  • Microsoft 365Sign in
  • GitLabSign in
  • DiscordSign in

Connect Google, GitHub and others and choose what agents can do

You sign in on the provider’s own page and pick what an agent is allowed to do. For example, it can read your email but not send it.

  • Uses PKCE or the device flow, so there’s no client secret
  • Read-only access means GET requests only
  • Tokens are refreshed on your phone

03Keys & tokens

Keep API keys on your phone

Add a key once and list the hosts it can be sent to. A request to any other host is refused before you’re asked.

  • Works with any API that takes a header
  • Hosts match exactly, with no wildcards
  • The Mac uses the key for one request and doesn’t keep it
stripeAuthorization: Bearer ••••••••••••
api.stripe.com
  1. GET api.stripe.com/v1/chargesApproved with Face ID
  2. POST paste.evil.example/uploadRefused, host not allowed
  3. GET api.stripe.com/v1/payoutsApproved with Face ID
  4. GET api.stripe.com.evil.example/v1Refused, host not allowed
  • any API
04Approvals

Approve anything else with Face ID

For deploys, deletions, payments and anything else you choose, the agent waits until you approve on your phone. When it has a run of calls to make, allow it for a while instead: one Face ID covers that agent for up to an hour. Your Mac keeps a log of each request and your answer.

Innkeeper — Log
  1. Hermes asked to deploy webApproved
  2. Codex asked to delete acme/old-siteDenied
  3. Pi asked to send an emailApproved
  4. omp asked for Google SheetsApproved
  5. Claude Code signed in to ArgoCDSaved

Hermes wants to deploy web to production.

Hermesexpires in 9m 52s
WhyShip the fix you merged
Commandkubectl rollout restart
AsksA yes or a no

Asked by

Approve with Face IDDeny
  • Each approval is signed over the exact request
  • If the request changes, the approval doesn’t match
  • Instant on the same Wi-Fi, through iCloud elsewhere

Pricing

Start with what you need.

Individual

One person. One Mac. One iPhone.

$0

Forever. No card.

Start free

Enterprise

Custom approval rules, integrations, and support.

Custom

Let’s scope it together.

Book a call

Try Innkeeper

Available on macOS 26 and the iOS App Store.

macOS 26 or laterDownload for MaciPhone, on the App StoreGet the App