Keychain reads your browser profile, active domain, email alias, and app context — then routes the right credential to the right role without you lifting a finger.
Chrome, Firefox, Arc, and Brave profiles auto-tag your session. Switch profiles — context switches with you. No manual selection.
URL patterns bind to credential contexts. *.stripe.com always gets the billing key. console.aws.amazon.com routes to infra.
Email domains and +tags resolve to org and role automatically. Sign up with a tagged address and the credential is already where it belongs.
IDE plugins, native apps, and the CLI declare context at invocation. keychain run --role=deploy injects exactly the right secrets.
Every email alias you use for work carries structure you already created — domain, organization, service, role. Keychain parses that structure and uses it to tag and route credentials automatically.
Roles bind credential path patterns to team members. When a member's context matches a role, they get that role's credentials — no individual copies, no drift, no stale shared docs.
Cloud infra and platform ops
Payment systems and finance
Product engineers and tools
Create named roles (infra, billing, eng) and bind credential path patterns to each. Assign team members.
Keychain reads your browser profile, active domain, email alias, or CLI flag and resolves your current context automatically.
The right key for that role is decrypted locally and delivered — to your browser, terminal, or app. No copy-paste. No vault hunting.
Define your roles, tag your emails, and let Keychain do the routing. Credentials live in your bucket. Intelligence lives in the client.
