The agent asks
It runs alicit run with a profile, a time limit and a justification. Nothing else changes in its workflow.
Private beta Credential approvals for AI agents
Your agents ask. You decide.
alicit puts your decision in front of every credential an agent uses. You see the exact operation on your iPhone, and Face ID signs your answer.
Try it yourselfHow it works
One command. One decision.
The agent does not hold a standing token. It asks for the smallest profile it needs, for a short time, and it says why.
Your iPhone shows the request
You see the operation, its exact inputs and the reason. Swipe right to approve. Swipe left to decline.
The credential stays sealed
The command gets a local proxy, not the real token. When the command stops, alicit revokes the token.
Try it
Your turn.
Approval requestednow
Open alicit to review.
Approve
Decline
Read
GitHub · alicit-ai
Hostbuild-mac
Repositoryalicit-ai/alicit
AgentClaude Code · 3f2a9c1e
Processgh
Path/v1/github/alicit-ai/token/issues
List the exact repository issues for the current implementation task
jev · clear
Reason fits 91% · Scope fits 80%
2m 0s
All caught up
A new request appears here when an Agent asks for a credential.
Released
Nothing released without you
Requests that a Policy releases on je valide's reading appear here.
History
No decisions yet
Requests you approve or decline appear here.
Up to 100 requests from the last seven days.
je valide
clearReason fits 91% · Scope fits 80%
DecisionApproved
Credential deliveryWritten to consumer · receipt unconfirmed
Requested
Profile
Signed in
Your approval key stays on this iPhone.
Releases a queue left checked out by an older app. It does not approve any request.
alicit 1.1.0 (397)
Requested from
Directory~/alicit
Repositoryalicit-ai/alicit
AgentClaude Code
Session3f2a9c1e
Request
MethodGET
/v1/github/alicit-ai/token/issues
Justification
List the exact repository issues for the current implementation task
je valide
Reason fits91%
Scope fits80%
Sign out of alicit?
alicit
Your credentials. Your decision.
Swipe right to approve
Swipe left to decline
Face ID signs every decision
A simulation made from the real alicit iOS app and CLI text. It does not connect to a Vault.
Principles
Small, short and signed.
The smallest profile
An agent asks for one server-owned profile, such as read access to one repository. It does not get a broad key that works everywhere.
The shortest time
Tokens last minutes, not months. Each time the agent needs a new credential, it asks again.
A key only your phone holds
The approval key lives in the Secure Enclave of your iPhone. The server checks the signature before it issues anything.
Built on OpenBao
alicit runs in front of an OpenBao vault that you control. Policy decides what an agent can request. You decide what it gets.
Let your agents work. Keep the keys.
alicit is in private beta. Ask us for an invitation.