Phone approver

An agent is most useful when you leave it running, which is exactly when nobody is there to click the dialog. A phone approver catches those requests.

Set it up

On a machine in your account, run keygrant devices add.
On your phone, open app.keygrant.app, enter the pairing code and a name for the phone.
Compare the fingerprint on both screens and type yes on the machine.
Optional: add the page to your home screen, so it opens like an app.

What happens

The desktop dialog appears as usual.
If nobody answers within 60 seconds, the request moves to your phone. The card shows the secret names, the requesting session and the full command.
You tap Allow or Deny within about two minutes. The answer goes back to the machine, which releases the secrets only if the answer verifies.

An explicit Deny on the desktop is final and never reaches the phone.

Keep the page open while you expect requests: it checks for new ones every few seconds. Push notifications are on the roadmap.

Why the relay can’t approve for you

The approver is a key pair created in your phone’s browser with WebCrypto, marked non-extractable: the page can use it to sign but can never read it out. Each verdict is signed over a hash of the whole request: secret names, command and session. The machine recomputes that hash from the request it actually holds before accepting the signature.

So the server that relays requests can’t approve anything itself, and can’t show your phone one command while releasing secrets for another. The machine also only accepts verdicts from approvers it verified at pairing (or with keygrant devices trust).

What the phone can’t do

The approver never receives the Secret Key or any vault key, and the server refuses it access to anything that holds key material. A lost phone can deny requests; it can’t read a secret. Remove it with keygrant devices remove.

The console runs on its own subdomain with a strict Content Security Policy, so no script from elsewhere on keygrant.app can reach the approver’s key.