Help with owner-approved credential delivery.

The Bridge is the separate macOS app that runs the keycourier-bridge command. It delivers an approved encrypted command to a fixed, owner-approved local destination. It does not have access to the vault Keychain and never returns a credential value to an AI client.

Download KeyCourier Bridge macOS 14 or later / version 1.0.0 / ZIP

File

KeyCourierBridge-notarized.zip

SHA-256

59b4e3b36aca472b8a86d75dbec28b32f1b8f0328c020585b5dd7e82e6c66f05

Install and pair

1. Verify the download before opening it. In Terminal, type shasum -a 256, add a space, drag KeyCourierBridge-notarized.zip from Finder into the Terminal window, press Return, and compare the result with the SHA-256 above. Stop if it does not match.
2. Open the ZIP in Finder and move keycourier-bridge.app to /Applications.
3. Make the command available in your local path. This optional link keeps the app bundle as the source of the command and does not replace an existing path:

   mkdir -p "$HOME/.local/bin"
   ln -s "/Applications/keycourier-bridge.app/Contents/MacOS/keycourier-bridge" "$HOME/.local/bin/keycourier-bridge"
   export PATH="$HOME/.local/bin:$PATH"

   The export applies to the current Terminal window. Add $HOME/.local/bin to your shell configuration for future windows. If ln says the destination already exists, inspect it before changing it.
4. Open KeyCourier for Mac and select the Bridge tab. In Terminal, run keycourier-bridge pair. The first run may return status: waitingForStore; return to the Bridge tab, choose Refresh, and run the command again.
5. When Terminal returns status: waitingForOwner and a pairingCode, compare that code with the one in Bridge setup. Select I confirmed the codes match, choose Trust this bridge, then run keycourier-bridge pair again. Complete the owner-authentication prompt. A successful pairing returns status: paired.
6. After pairing, configure one local destination. Replace the example IDs, path and variable names before running one of these commands. The path must be absolute and its parent directory must already exist:

   keycourier-bridge configure \
     --consumer local-service \
     --name "Local service" \
     --target this-mac \
     --path "/Users/your-name/project/.env" \
     --variable SERVICE_API_KEY
   
   keycourier-bridge configure-login \
     --consumer local-login \
     --name "Local login" \
     --target this-mac \
     --path "/Users/your-name/project/.env" \
     --username-variable SERVICE_USERNAME \
     --password-variable SERVICE_PASSWORD

   Use configure for one value or configure-login for a username and password. Both commands require owner authentication. The saved profile is fixed before an AI can request delivery; request-time paths and commands are rejected.