Innkeeper: 2FA for Al Agents for iOS

Routes AI agent authentication requests to your iPhone so you can inspect the exact request bytes and approve actions with Face ID and the Secure Enclave. Developed by Denislav Denislavov Gavrilov, Innkeeper pairs an iPhone and a Mac app to add a human approval step for autonomous agents. Key functions include context-aware signing, one-time encrypted pairing, push notifications, and a zero-credential escrow model. It fits AI developers, power users, and security professionals who require supervised agent access.

What tasks can you actually use it for?

Innkeeper routes authentication attempts from agentic tools to a human reviewer, letting that reviewer confirm a single, specific action before the agent proceeds. The app displays the tool name, exact arguments, and remaining approval time so signatures match the visible request, which enforces a WYSIWYS signing flow. Use cases in the source material target supervised automation for agents that otherwise require stored credentials or TOTP seeds.

How trustworthy are the approvals and signed responses?

The approval flow relies on hardware-backed keys stored on the phone, with Face ID used for authorizing each signature. Approvals are produced as one-time signed confirmations for a single action, and agents never receive long-lived secrets or TOTP seeds. The design isolates credential material on the device and produces explicit, inspectable approvals that an agent can present to services without holding the underlying secret.

What inputs and environment does it require?

Innkeeper requires an iPhone running iOS 17.0 or later and a paired Mac running macOS 14.0 or later; the iPhone app works only in tandem with the Mac application. Devices pair once using encrypted keys over a local network, and a secure relay handles remote connections without being able to read encrypted payloads. The workflow therefore depends on a paired desktop environment rather than standalone mobile operation.

How does it fit into developer and security workflows?

The app is positioned for AI developers, power users, and security professionals who need a supervised gate between agents and protected accounts. It removes the need to hand agents permanent credentials, replacing credential escrow with human approvals and push alerts. The developer describes a privacy-first model that requires no account, analytics, or external sign-in, so teams can add human oversight without sending sensitive data to third-party services.

Who should adopt this approach and what tradeoffs it enforces

Innkeeper is a focused option for developers and security-minded users who accept manual approvals in exchange for removing long-lived credentials from agent control. That tradeoff shifts risk management back to people rather than agents, which reduces unattended automation but tightens control over sensitive access. Choose it when supervised, verifiable approvals are an operational requirement rather than a convenience.