Keys to the Kingdom

Keys2Kingdom lets a local browser agent sign in without putting the username or password in the agent conversation.

It is open source under the MIT license.

It has two small parts:

1. A Chrome extension adds an Open with Keys2Kingdom button only to login pages approved by the calling app.
2. A local helper reads that site's values from the macOS Keychain, fills the form, and submits it.

The button appears only when one approved username field, password field, and form are present together. Same-site login forms inside a page frame work too.

The agent sees the button and the page after login. It does not receive a command for showing saved values.

Website rules belong to the caller

K2K does not contain real website addresses or login-field details.

The app using K2K supplies a small profile containing those details. K2K checks the profile and generates Chrome access for only those exact sites. Passwords and usernames never belong in the profile.

See PROFILE.md for the profile format. The repository includes a harmless localhost example only.

Try the harmless proof

Install K2K with the example profile:

./scripts/install.sh ./examples/proof-profile.json

Then open chrome://extensions, turn on Developer mode, choose Load unpacked, and select:

~/Library/Application Support/Keys2Kingdom/extension

Save harmless proof values:

~/Library/Application\ Support/Keys2Kingdom/bin/k2k save proof

Start the local proof page:

./scripts/run-proof.sh

Open http://127.0.0.1:18765, then click Open with Keys2Kingdom.

Commands

k2k validate-profile <file>  Check a caller-supplied profile without installing it.
k2k install-profile <file>   Install a checked profile and generate exact Chrome access.
k2k save <site>              Ask for a username and hidden password, then save them locally.
k2k remove <site>            Remove that site's two saved values.
k2k status <site>            Report only whether both values exist.

There is deliberately no command for showing saved values.

Safety rules

• Values stay in the local macOS Keychain and do not sync to iCloud.
• They become available only after the owning user has logged into the Mac once after a restart.
• Website rules come from the calling app, not K2K core.
• Profiles must use exact HTTPS addresses. Plain HTTP is allowed only for localhost tests.
• Wildcard website addresses are rejected.
• Chrome access is generated from the checked profile and remains limited to those sites.
• The helper writes no password or username to its output or logs.
• The extension fills and submits login forms only. It does not perform account actions.

Updating a caller profile

Run the installer again with the updated profile, then reload the unpacked extension in Chrome. K2K keeps the same extension identity and Keychain entries.