Keys that cannot leave
Keys are created in the Secure Enclave. There is no export, not in the app, not on the command line, not over the agent socket. Existing Ed25519 and RSA keys can be imported and are marked as less protected.
SSH agent for macOS
Know who uses your SSH key, and for what.
Keyhatch keeps your SSH keys in the Secure Enclave of your Mac. Before a key signs anything, you see which app asks, through which chain of programs, for which server, and you decide with Touch ID, on your iPhone, on your Apple Watch or on a second Mac.
Download the free trial Buy for 29.90 €
7 days free, no account. macOS 26 or later, Apple Silicon.
Sign in to github.com
as git · key “MacBook”
✓ Host verified
Requested by
Claude
Claude › zsh › git › ssh
in ~/Software/keyhatch
⚠ Process details can be faked by other apps on this Mac.
Approval lasts
This time only5 min15 min1 h
What Keyhatch does
Every request with context
Which app started it, the chain of programs in between, the working directory, the purpose (sign-in, Git signature, forwarding) and the server. With OpenSSH 8.9 or later the server is proven cryptographically, not guessed from a host name.
Approve from anywhere
A request reaches your iPhone, Apple Watch or a second Mac, end-to-end encrypted. The relay in between only sees ciphertext and cannot approve anything. At the Mac, Touch ID always works in parallel.
Rules that say what they are
Hard rules (server, purpose, forwarding) are enforced by the agent. Rules about programs and folders are labelled guard rails, because other software on your Mac can fake them. Keyhatch says so in the dialog.
A log you can trust
Every signature, approval and denial, with app, server and key, in a hash chain anchored in the Keychain. Gaps and edits show up. Export as CSV or JSON.
Set up in minutes
The assistant writes your SSH and Git configuration with a preview of every change and an undo, adds the key to GitHub through the gh tool if you have it, and checks the setup on request.
iPhone and Apple Watch
The free Keyhatch apps for iPhone and Apple Watch receive requests from your Mac. You see the same details as on the Mac and approve with Face ID. Pairing works with a code on screen, nothing is stored in the cloud.
- End-to-end encrypted
- Expires after 60 seconds
- Bound to exactly one signature
Keyhatch
Sign in to github.com
Claude · as git · key “MacBook”
Compared with other agents
| Keyhatch | Secretive | macOS built-in | |
|---|---|---|---|
| Keys in the Secure Enclave | yes | yes | yes |
| Shows the requesting app chain | yes | app only | no |
| Server proven via session-bind | yes | no | no |
| Approve on iPhone or Watch | yes | no | no |
| Rules per server and purpose | yes | no | no |
| Tamper-evident log | yes | no | no |
| Price | 29.90 € once | free | free |
As of October 2026, from the public documentation of each product.
Security, in the open
Keyhatch is a security tool, so what it cannot do matters as much as what it can.
- Keyhatch has not been audited by a third party. Three internal review passes are published with their findings.
- Remote approval is enforced by the app, not by hardware. Malware with root rights on your Mac could use a remote-approvable key, but never copy it. Keys protected with Touch ID on the Mac are hardware-enforced.
- No telemetry, no crash reports, no account. The only connections are the relay (if you paired a device), update checks and a weekly check of the revocation list (with a license).
- The source code is published under the Elastic License 2.0 with version 1.0: anyone can read, build and check it.
One price, no subscription
29.90 €
once, including VAT
- One person, up to five Macs
- All 1.x updates included
- Security updates for 5 years
- iPhone and Watch apps free
- 14 days refund, no reason needed
Try it 7 days for free first. After the trial, your keys keep working with approval at the Mac; only remote approval, rules that allow without asking and log export pause.
Questions
What happens when the trial ends?
Nothing breaks. Your keys keep working, and every request asks for Touch ID on this Mac. Remote approval, rules that allow without asking and log export pause until you add a license.
Why is it not in the Mac App Store?
The App Store sandbox would not allow a socket that every app on your Mac can reach, writing your SSH and Git configuration, or seeing which program asks for a key. That is the core of Keyhatch, so it is signed with Apple's Developer ID and notarized instead.
Can I move my existing keys?
Yes. Keyhatch imports OpenSSH, PEM and PKCS#8 keys (also encrypted) and moves the original file to the Trash. Imported keys are marked as less protected, because they existed outside the Secure Enclave. A new Secure Enclave key is better.
Does it work with Git signing, GitHub and coding agents?
Yes. Keyhatch signs Git commits, adds keys to GitHub, and recognises coding agents such as Claude Code in the chain of programs, so you can see and limit what they do with your keys.
What if I lose my Mac or iPhone?
Keys in the Secure Enclave cannot be copied off a lost Mac. On the iPhone you can mark the Mac as lost, which drops its requests. The assistant asks you to set up a second way in, such as a second key, before you rely on one.
Who sells Keyhatch?
The payment is handled by Link (Link, LLC), Stripe's merchant of record, which also charges and pays the VAT of your country. The license and support come from BYTEPOTATO UG (haftungsbeschränkt) in Germany.