twice

Your agents make a list. Twice checks it twice. When an agent on your Mac asks for a 1Password item, nothing happens until another of your devices says yes. With the two you start with, that's your iPhone.

Download for Mac iPhone app soon

An agent asks.

Claude, Codex, or a script you forgot about wants your GitHub token. Twice catches the request on your Mac.

Your phone buzzes.

It says which agent, which item, and from which folder. Face ID if you like it, a decline if you don't.

Two keys turn.

Your Mac and your iPhone each hold a share of the key. Neither one can open the password alone. That's the whole trick.

Specs, for the curious

approvals: 2 devices to start: your Mac and your iPhone. You can add more later.
the key: One group signing key, split into shares (FROST threshold signatures). Never whole in one place.
keys made with: ChillDKG, so no device ever held the whole signing key, not even at the start
your password: Sealed to the group. It opens only when enough devices agree.
on the iPhone: Its share sits behind the Secure Enclave and Face ID
the relay: Passes messages along. It can't read your requests or your secrets.
works with: 1Password's command line tool, and any agent that can run it
needs: A Mac with Apple silicon on macOS 15 or later, an iPhone on iOS 18 or later, and a 1Password account
coins: None. This is the other kind of crypto.
price: Free