Vouch: Hardware-Backed Developer Credentials
Vouch is an open-source credential broker that issues short-lived SSH keys, AWS sessions, GitHub tokens, and Kubernetes configs after a single FIDO2 hardware verification.
The problem with long-lived credentials
Credential sprawl
SSH keys that never rotate. AWS access keys in plaintext. GitHub PATs that never expire. Every tool has its own long-lived secret.
No presence verification
Existing MFA verifies devices, not humans. A compromised laptop with cached credentials is indistinguishable from its owner.
AI agents with full access
AI coding assistants get your credentials with no scoping, no audit trail, and no way to distinguish human from agent actions.
How it works
One FIDO2 authentication issues credentials for every integrated tool, for up to 8 hours.
Touch your YubiKey
FIDO2 verification with PIN ensures a human is present. Phishing-resistant by design.
Vouch issues credentials
Short-lived, scoped, hardware-attested, and bound to your device. SSH certificates, AWS sessions, GitHub tokens.
Your tools authenticate automatically
Native integration with SSH, AWS CLI, git, kubectl, docker, and cargo. No wrappers.
Integrations
Native support for the tools your team already uses.
AWS
credential_process for STS federation
SSH
Signed certificates, no more authorized_keys
GitHub
Short-lived tokens via git credential helper
Kubernetes
exec plugin for kubectl and EKS
Docker
Native credential helper for ECR and GHCR
Cargo
Private registry authentication
AWS CodeArtifact
Package repository tokens for pip, npm, Cargo
AWS CodeCommit
Git credential helper for AWS repositories
Give AI agents credentials, not your keys
Grant scoped, time-limited credentials to AI coding assistants. Full audit trails cryptographically distinguish human actions from agent actions. Revoke instantly.
Open source and auditable
Vouch is fully open source under the Apache-2.0/MIT dual license. The full source is available for audit.
