James Washington
writing about archive utils free game ideas replays
Command-line tool

seed-headless-tokens

Sets up the login tokens that remote terminal sessions need, entered hidden at the console.

built Aug 2026 The server in the closet

how it works

Writes 0600 token files under ~/.config because ssh sessions cannot read the login Keychain; hidden prompt, never touches history.

Command-line tool: A small program run from the terminal.

The code for this one lives in a private repo. This page explains the idea so you can build your own.

clisecretsssh

related

  • Headless shells need 0600 token files Technique Remote terminal sessions can't open the Mac's password vault, so they need separate locked-down token files.
  • devenv-* Keychain secret helpers Command-line tool One locked vault for all ~41 API keys, with commands to add or read a secret without it appearing on screen.
  • Run the tmux server in the GUI session so ssh panes can read Keychain Technique Lets remote terminal sessions use stored passwords and browser tools as if you were at the desk.
  • One Keychain item for all shell secrets (base64 or bust) Technique Keep every API key in one locked vault instead of in shell config files, without slowing down new terminals.
  • authgate: switch CLI logins between profiles Command-line tool One command to swap which account your developer tools are logged into.
← everything I've built
© 2026 James Washington
github twitter rss