grantpin puts an approval gate between coding agents and API keys

Field notes

The page shows an interactive deployment example, then describes a menu-bar app and CLI for adding and referencing secrets by name. Standing grants can be limited by caller label, project directory, secret names, and command prefix; their uses remain in the audit log. Its documented boundary is important: grantpin does not sandbox commands or restrict network access, and redaction only catches exact matches, so an approved process can still transmit a secret.