Download KeyValet
macOS and Linux releases, the unsigned Windows local preview, source code, checksums, and release signing status.
KeyValet is a free, Apache-2.0 open-source credential broker for AI agents and developer tools. It stores credentials locally and lets you control how automated tools use them. Start with the guide, Privacy policy, and Code signing policy.
macOS and Linux
Download published releases on GitHub. Select the archive for your operating system and architecture, and check the release's SHA256SUMS.
| Platform | Available release | Signing status |
|---|---|---|
| macOS, Apple Silicon | macOS arm64 archive | Simvito Limited Developer ID signature and Apple notarization. |
| Linux, x64 / ARM64 | Native Linux archives | Published SHA256 checksums; these are not Windows Authenticode signatures. |
The installer selects the platform-specific release:
curl -fsSL https://keyvalet.dev/install.sh | sh
Windows x64 local development preview
Unsigned preview, 14 October 2026. This package is for local development and evaluation. It is not a signed production release. Windows may warn about or block downloaded unsigned programs. Windows remote pairing and approval are unavailable in this package because its relay requires a valid publisher signature.
- Download the Windows x64 preview ZIP (22,168,175 bytes).
- SHA256 checksums.
- Corresponding source snapshot, including the source manifest and build instructions.
- Build and validation receipt.
ZIP SHA256:
3cd969a332bb6eb1678ac48fb0e4d300bb12075e104c4bc13b0e0651acf344aa
The native Windows release build and VM installation passed; all seven installed program hashes matched the package, and the installed help/status commands succeeded. Same-source development builds have physical Windows Hello setup/unlock and hardware-key evidence. The complete live AI-client workflow and protected cancellation lifecycle remain under acceptance. Browser-download/SmartScreen behavior has not been tested.
Enable Windows Hello first. Extract the ZIP, then run its installer from the intended user's normal PowerShell. Replace the placeholder with the full path to your downloaded ZIP; UAC handles system installation:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\install.ps1 `
-PackagePath '<full-path-to-the-downloaded-preview.zip>' -AllowUnsignedAgent
-AllowUnsignedAgent explicitly selects local development trust. It does not enable an unsigned relay. Credential operations use the protected installed directory; this is an installer package, not a portable vault. Read WINDOWS-PREVIEW.txt and the included Windows guide for setup and uninstall instructions. Preserve an existing vault and a consistent backup before upgrading.
Code signing policy
We are preparing an application for free Windows signing through SignPath Foundation. SignPath signing is not yet enabled and no approval has been granted. If approved, free code signing will be provided by SignPath.io, with a certificate issued to SignPath Foundation. See the Code signing policy for the team, approval process and current integration limits.
The source for published releases is available in the repository. The local Windows preview has a separate corresponding source snapshot linked above; it is not claimed to be a GitHub Actions or SignPath-attested build.