LEASH

Hold the keys.
Let agents work.

Sign in with a passkey. Your phone, laptop or security key is your login, and the same tap approves held calls.

New to LEASH?

No password, no email. Your passkey never leaves your device.

Not affiliated with GitHub, Cloudflare, Railway, Stripe or Supabase.

Heldcoding-agent
DELETE /repos/acme/app

Deletes the repository. This cannot be undone.

Approve with passkeyDeny
GET /pullsallowed
POST /issuesallowed
GET /actions/runsallowed
LEASH
Held0 Vault Agent tokens Audit log Account
?

Sign in the LEASH CLI?

A terminal is asking to sign in with code . Only approve if you just ran leash login.

Held

Irreversible calls your agents tried. Nothing happens until you decide.

All clear

When an agent tries something it can't take back, it waits here and on your phone.

Vault

Your real API keys. Encrypted, never shown again, never given to an agent.

No keys yet.

Add a key

Agent tokens

What your agents hold instead of keys. Scoped, expiring, revocable.

No tokens yet.

New token

Audit log

Append-only. Each entry commits to the one before it.

Account

Your data, and how to take it all away.

What LEASH keeps about you

Your name, your passkey's public key, your encrypted vault, token hashes, holds and your audit log. Never your face, fingerprint or readable keys. Privacy policy

Delete account

Erases your account, passkeys, vault, tokens, holds, sessions and audit log immediately. Agents using your tokens stop working. This cannot be undone.