Latchkey
CLI that injects encrypted stored credentials into curl calls for 30+ services
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 17, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · ba6b69d
Installed the npm CLI (v2.21.0) and verified the core claim live: registered a self-hosted service, stored a token, and watched `latchkey curl` inject the PRIVATE-TOKEN header into a local echo server while the command line contained no secret — plain curl sent nothing. Credentials land on disk encrypted (no plaintext token in the store file) and injection is URL-scoped: requests outside the registered base path are refused. Headless environments need LATCHKEY_ENCRYPTION_KEY exported since there is no keychain; the browser-login flow needs a GUI and was not tested.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 9/10
- Docs & honesty 5/5
What Latchkey does
Wraps curl so Claude can call authenticated HTTP APIs (GitHub, Slack, Google Workspace, AWS, Stripe, and 30+ services) without ever seeing your tokens: credentials are stored AES-encrypted locally and injected only into requests matching the service's registered base URL. Supports manual token setup, browser-login credential extraction, and registering self-hosted instances. Triggers when you ask Claude to act on your behalf against a service's HTTP API.
How to install Latchkey
git clone https://github.com/imbue-ai/latchkey
mkdir -p ~/.claude/skills
cd latchkey && cp -r skills/generic/latchkey ~/.claude/skills/latchkey
npm install -g latchkey
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Latchkey
-
/latchkeyCLI that injects encrypted stored credentials into curl calls for 30+ services
It also activates on plain-language prompts like these:
-
Call the GitHub API for me without ever showing me my token -
Register this self-hosted GitLab instance and store its token -
Hit the Stripe API on my behalf using my stored credentials
Frequently asked questions
- Is the Latchkey skill free?
- Yes. The skill itself is free from imbue-ai/latchkey. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Latchkey work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 17, 2026. Verdict: Tested · Works. Installed the npm CLI (v2.21.0) and verified the core claim live: registered a self-hosted service, stored a token, and watched `latchkey curl` inject the PRIVATE-TOKEN header into a local echo server while the command line contained no secret — plain curl sent nothing. Credentials land on disk encrypted (no plaintext token in the store file) and injection is URL-scoped: requests outside the registered base path are refused. Headless environments need LATCHKEY_ENCRYPTION_KEY exported since there is no keychain; the browser-login flow needs a GUI and was not tested.
- What is the Latchkey SkillProof Score?
- 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
- How do I install Latchkey?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Latchkey with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.