Just-in-time credentials for your dev machine.
Documentation·Quickstart·Supported tools·Command reference·Security
Status:macOS-only (Apple Silicon), and still in development.
jitmoves each secret into a local encrypted vault gated by Touch ID, and
rewrites the files so your tools keep working. On disk there’s now a decoy. The
real value only appears, in memory, for the specific process that asked for it,
after a biometric prompt. The result: you unlock once,jitasks before handing
a credential to a tool (or an agent), and there’s a decoy on disk the rest of
the time.
Pick one route. If you installed from the tarball before and are switching to
Homebrew, remove the old copy after thebrew install(sudo rm /usr/local/bin/jit); otherwise two jits sit on PATH upgrading separately, andjit doctorwill flag it.
Releases are signed with a Developer ID and notarized by Apple, so both paths
run without a Gatekeeper prompt: Homebrew quarantines its downloads and
Gatekeeper clears them against the notarization ticket, whilecurl(andgo install) set no quarantine flag at all. To check what you got rather than
take our word for it, runjit doctor— itsjitline reportssigned CZC6BH93GJ, using the same checkjit upgraderuns before it will
install anything.
Upgrading:brew upgrade jitpass, orjit upgrade— a verified
self-update (Developer-ID signature and checksum both checked before the
swap, restarts the service). Either way your vault is untouched.
Homebrew installs shell completion with the binary, sojit completes
subcommands, flags, vault paths, and wrappable tool names out of the box.
Installed from the tarball or from source, add it yourself:
Either way,jit doctortells you if completion isn’t reaching your shell.
jit scanwith no path sweeps your whole home directory, so give it a moment on
a large one. To go straight at one place, point it at a path:jit scan ~/.aws.
Day to day it’s mostlyjit run — . For CLIs that carry their own login
token (gh,glab,stripe, and more) youjit wrap ghonce and then keep
typingghas normal forever.
Not sure whether something needsjit wrap,jit migrate, or nothing? You
don’t have to know.jit scansplits everything it finds into what jit will
protect (one command – the wraps included) and what only you can fix, and
barejit migrateruns that whole plan: