Back to Authsia

Use Authsia in five pictures

App setup, vault boundaries, workspace daily loop, Access Center, and agent-safe runs—without a wall of prose.

Get started CLI guide

First run

Install once, launch once, then enable only the CLI surface you need.

1. Install DMG or Homebrew 2. Launch register bridge 3. Add items folders · secrets 4. CLI toggles global + per item

Offline by default

Vault data stays on your Mac through Apple security services.

Narrow folders early

Team/API, Production, Infra/SSH—grants later mirror these boundaries.

App-only when needed

Disable CLI on items that should never leave the app UI.

Vault as an access boundary

Folders and CLI toggles are the main safety controls.

Vault Team/API Production CLI on CLI off = app-only

Prefer references

Put authsia:// refs in scripts and env files. Secrets resolve only at approved runtime.

SSH via the agent

Git and SSH should sign through Authsia’s agent—not by exporting private keys into the shell.

Copy Path stays shell-ready

Copy Path yields export NAME='authsia://...' so pasted refs stay visible to child commands.

Workspace daily loop

Create once from the app, then open terminal, guarded terminal, or agents from the same folder.

Create scan env · write refs Health Ready / Needs attention Open menu Terminal Guarded terminal Agent tools Maintain update · reset · pin

Commit-safe config

.authsia/workspace.json holds name, folder, env files, and agent rules—not plaintext secrets.

Nearest workspace wins

Commands search upward for workspace config. A nested config is a separate workspace.

Env before depth

Active Production tags beat deeper Default items. Same-tier ties fail closed.

Parent stays clean

Guarded launches inject plaintext only into new child processes.

Terminal equivalents

authsia workspace status
authsia workspace run -- npm test
authsia guard
authsia unguard
authsia workspace agent --tool codex --dry-run

Access Center

See who can use the vault, for how long, and revoke without editing project files.

Agent grants folder · items · TTL · revoke Mac or iPhone approve Human sessions TTY + token for IDE revoke ends access Insights / flags display-only signals no silent AI calls

Remote JIT

Approve or deny from a paired iPhone when you are away from the Mac.

Investigation flags

Info / Review / Warning are local display cues. They do not revoke or authorize.

Click to focus

Insights summarize recent access by item and folder so you can drill in quickly.

Agent-safe workflows

Keep plaintext out of prompts, diffs, and terminal output agents can observe.

Avoid plaintext get/read in agent context Files agents can read API_KEY=authsia://… safe to inspect Approved exec JIT or automation secret in child only

Without JIT

Unlock as a human or supply a scoped automation credential. Agents must stop when access is missing—not fall back to plaintext commands.

With JIT

Confirmed agent context uses scoped folder grants for exec and list. Deny or expiry ends the path.

Need the commands?

Agent launch, access create/revoke, and guarded shell live in the CLI guide.

Open agent JIT

Quick checks

Status

authsia status for bridge, shell, session, and SSH agent.

Diagnostics

authsia doctor when setup looks stale.

Lock

authsia lock or revoke in Access Center to end sessions.