Get your key ready for Safari.

Keycode fills TOTP verification codes from your YubiKey on Mac. The beta is available by invitation. The application interface is currently in French.

First use

1. Connect an OATH-compatible USB YubiKey with CCID enabled and a TOTP account already configured.
2. Open Keycode and enable its extension in Safari settings.
3. Allow Keycode on your HTTPS sign-in website.
4. Open the popup from the toolbar or the proposed ⌘⇧Y shortcut. Unlock your key if needed, choose an account, check the exact website address and confirm the association.

Several accounts on one site

Add accounts in the popup. A site with one linked account fills automatically. With several accounts, choose one for your current sign-in, then fill the field. Navigation clears that choice.

The key is locked

Use the OATH password configured in Yubico Authenticator. Optional Keychain storage is local to this Mac and protected by Touch ID or macOS authentication. A session lasts at most fifteen minutes and may end sooner if Safari ends the native process. “Verrouiller maintenant” locks immediately; “Supprimer du Trousseau” deletes the saved password.

If the account picker reports a locked key, use the unlock button next to the error. After successful Keychain authentication, Keycode reads the accounts again and preserves your search.

A code does not fill

• Check website access in Safari and reload the page.
• Connect the key associated with the site. Close other requests if the key is busy.
• Choose the account and, if needed, the target field. The field must be empty, on the active top-level page in the frontmost Safari window.
• Touch the key when it requires it. After an error, retry explicitly.
• If no supported empty field is detected, the popup can display a temporary code for manual entry once an account is associated.

Compatibility

Intel or Apple Silicon Mac, macOS 13 and Safari 17 or later. An OATH-compatible USB YubiKey is required. FIDO-only Security Key devices, iPhone/iPad, HOTP and Steam codes are not supported. HTTP pages, embedded frames and private browsing are excluded. Keycode does not submit forms.

Contact

Email vitalys@rougetet.com with your macOS, Safari and Keycode versions and the error message. Never send an OATH password, TOTP secret or sign-in code.