Compare
Forkbench vs Keyway
Keyway is a secrets manager for repositories: a CLI and a web dashboard that keep values out of your .env file and hand them to a process you launch with keyway run.
Updated
Keyway is a secrets manager for repositories: it keeps values out of your .env and hands them to a process you start. Forkbench is the Mac app the agents run in, so a key sits with the rest of one job, its plan, its notes and its people, and the command uses it while the agent sees only the result.
Keyway and Forkbench answer the same complaint, that a coding agent reads your .env because your .env is just another file in the working directory, and they answer it from different places. Keyway sits beside the repository: it holds the values, syncs them to whoever has repo access, and injects them into the process you launch, on any platform and in CI. Forkbench sits where the agents actually run, so the key is one of the things a piece of work holds, next to its plan, its notes, its board and the people on it.
| Forkbench | Keyway | |
|---|---|---|
| What it is | A Mac app where your agents run, one Thread per piece of work | A secrets manager for repositories: CLI plus web dashboard |
| What a grant is scoped to | A Thread: its keys, its notes, its board and its people | A repository and its environments |
| How the value reaches the command | The command receives the value, the agent receives the result | Injected as environment variables into the process you launch, "invisible to AI agents" |
| Key locked to one destination | Yes, set when the key is created; anything else is blocked and logged | Not published |
| Folder scope the kernel enforces | Yes, per Thread, inherited by every process a shell spawns | Not part of it |
| Where it runs | macOS 13+ | macOS, Linux, Windows, plus CI (GitHub Actions, GitLab) |
| Sharing with people | Invite someone into a Thread and they get that Thread's key, nothing else | Unlimited collaborators on every tier; audit logs from Team up |
| Open source | Closed | Open source and self-hostable |
| The agents themselves | Run here, in a real login shell, with a board that outlives the session | Run wherever you run them; Keyway starts the process |
| Price | Free; Pro €30/mo; Team $30/seat, dropping to $20 at scale | Free (1 private repo); Pro 9 EUR/mo; Team 19 EUR/mo; Business 39 EUR/mo |
Where Keyway is strong
- It is not tied to a Mac. The CLI installs on macOS, Linux and Windows, with a web dashboard alongside it, so the same secrets follow you onto a server or a colleague's Ubuntu laptop.
- It runs in CI, which is where a great many secrets actually have to be. GitHub Actions and GitLab are documented, and there is a published action for it.
- Secrets follow repository access, which is a genuinely good answer to offboarding: in their words, "When someone leaves, revoke their GitHub access. No secrets to rotate."
- It is open source and self-hostable, and the paid tiers are cheap: 9 euros a month for Pro, 19 for Team with audit logs and member management, 39 for Business.
- Unlimited collaborators on every tier, including the free one. If what you need is a team sharing one set of values across many repos, that is the thing Keyway is built to do and Forkbench is not.
Where Forkbench differs
- The grant is the job, not the repository. A Thread holds its own plan, its own notes, its own keys and its own people, so what an agent can reach is decided by which piece of work it was put on, and everything else is deny by default.
- Put the key in Vault and the command that needs it receives the value while the agent receives the result, so the key stays out of the prompt, the command line and the transcript. It is containment rather than a guarantee: a command you authorised can still print what it was handed. Vault is part of Pro.
- A key is locked to its destination when it is created, and an agent cannot change that later. Forkbench restricts which hosts a key may reach, and blocks and logs the rest.
- Folders the macOS kernel enforces. A Thread can be locked to the folders the job is about, applied as each shell starts and inherited by every process it spawns, so a build script and a dependency's install hook are inside the same boundary.
- The agents are already here. Forkbench is the app they run in, so the notes they read, the board they claim work from and the keys they use are all one Thread's, and a second agent picks the job up where the first left it.
The bottom line
If your secrets belong to repositories and have to reach Linux boxes, CI runs and colleagues on other operating systems, pick Keyway: it is cheap, open source, self-hostable, and offboarding by revoking GitHub access is a better answer than most. If what you are actually managing is agents on a Mac, the useful question is not where the value is stored but what one agent is allowed to touch at all, and that is what a Thread decides: its keys, its notes, its board, its people. The two are not exclusive. Keyway run works fine inside a Forkbench pane.
Keyway questions
Can I use Keyway and Forkbench together?
Yes. Every Forkbench pane is a real login shell, so keyway run -- your-command works exactly as it does in any terminal, with your PATH and shell config unchanged. People commonly keep team-wide values in a secrets manager and put the keys that one job needs into that Thread's Vault, so the agent working that job has the one credential and nothing else.
Does Forkbench work on Linux, Windows or in CI the way Keyway does?
No. Forkbench is a native macOS app and the work happens on the Mac in front of you, so Keyway is the better tool if your secrets have to reach a build runner, a server or a colleague on another operating system. Its CLI installs on macOS, Linux and Windows and it publishes a GitHub Actions integration.
What is the real difference if both keep the value out of the agent's context?
The scope. Keyway decides access by repository, so anything running against that repo can use those values. Forkbench decides it by piece of work: a Thread holds its own keys, notes, board and people, a key is locked to its destination when it is created, and anything aimed elsewhere is blocked and logged. One answers who may have the secret; the other answers which job it belongs to.
Keep reading
Sources
Comparison based on publicly available information, checked on the date above. Spot something out of date? Tell us.