The credential layer for local AI agents
25+ services supported out of the box. Register any HTTP API at runtime. Works with Claude Code, OpenCode, Codex, and more.
REST, not MCP
Call any API the way you already do. No new protocol, no special client, no extra runtime.
One command, every surface
The same calls work in your editor, your terminal, your CI, your agent. Build once, run anywhere you write code.
Pure passthrough auth
Your request goes straight to the API. Latchkey handles the keys and gets out of the way.
Features
Sign in like a human
Latchkey opens a browser, you log in, it captures the token and closes the tab.
Keys encrypted at rest
Tokens live under ~/.latchkey, locked with a password from your system keyring.
Handles the weird auth
AWS signatures, Telegram URL tokens, anything that won't fit in a static header. Latchkey rewrites each call.
Self-hosted, same syntax
Point it at your GitLab, your internal Sentry, any HTTP API behind your VPN. Register once, call it like any public service.
Survives token refresh
Re-auth in one command. Your long-running agent picks up the new credentials without a restart.
One command to inspect
Latchkey services info tells you whether a credential is valid, invalid, or missing. No more guessing why a call 401'd.
That's the key detail - decoupled credential lifecycle means the agent can keep running across token refreshes. Makes Latchkey much more practical for long-running workflows.
Sent this to a couple of engineers I know who are building local agent setups. They've been duct-taping credential management together for months, this is right up their alley.
Built by people who care, for people who build
I wanted to work on Latchkey because I felt that there was a real gap in the agentic ecosystem. As a developer and free software enthusiast, it seemed to me that there was no way to build a locally running user-facing application:
— That would let AI agents access user data across various third-party platforms
— Without relying on data connectors operated by intermediaries
— While being reasonably friendly to non-technical users
Latchkey was meant to change that by providing creative ways of transforming local browser logins into authentication artifacts usable in agentic flows. Its focus has since shifted a bit towards credential and permission management, but the original motivation remains a big part of why I'm still working on it.
Frequently asked questions
What is Latchkey?
A command-line tool that injects API credentials into your agent's curl calls. You log in once. Your agent runs standard curl. Latchkey adds the auth header on the way out.
How is this different from MCP?
No intermediary, no new protocol. Latchkey hands your request straight to the API. MCP wraps every service in a server you have to host. Latchkey just patches the auth into curl.
How do I get started?
npm install -g latchkey, then latchkey auth browser <service> to log in. Your agent calls latchkey curl ... from there. Run latchkey ensure-browser once if you want browser login.
Which services are supported?
AWS, Calendly, Discord, Dropbox, Figma, GitHub, GitLab, Gmail, Google Workspace, Linear, Mailchimp, Notion, Sentry, Slack, Stripe, Telegram, Yelp, Zoom, and more landing each release.
Can I add a service that isn't on the list?
Yes. latchkey services register <name> --base-api-url=... plus latchkey auth set with your token. Works for self-hosted GitLab, Mastodon, internal APIs, anything that takes static auth.
Where are my credentials stored?
Encrypted on your machine under ~/.latchkey. Nothing leaves your computer except the actual API calls you make.