Keyward
Documentation Start Updated

Getting started

What you need, how Keyward Desktop will be installed and activated, how a first caller is allowed and a first secret kept, and where to go next; written against the design, and marked where nothing can be done yet.

Nothing to install yet. Keyward Desktop is designed and not built; there is no installer on the downloads page. This guide describes the first release as designed, so that what it will ask of you is known in advance. It will be rewritten against the real installer when one exists.

What you need

  • A computer with Windows 10, Windows 11 or Windows Server 2022 or 2025, 64-bit, with a TPM 2.0 (a virtual machine needs a virtual TPM; without one the Service runs in a fallback mode and says so).
  • A license key (it looks like KW-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX). One license covers Keyward Desktop and the command line. In early access, licenses go to Exprezoe's staff and to the testers we invite.

Installing the Keyward Service needs administrator rights once: a Windows service cannot be registered without them. Everything after that runs as your account.

1. Download

  1. Open Downloads and sign in with your license key.
  2. Download Keyward-Setup-<version>-win-x64.exe. It installs the Keyward Service and Keyward Desktop together.
  3. Before you run a file, verify it against the SHA-256 shown on the downloads page. The installers will not be signed with a publisher certificate at first, so the checksum is how you know the file is the one we released.

2. Install

Run the installer. Windows SmartScreen says "Windows protected your PC" and that the publisher is unknown: choose More info, then Run anyway. That warning is expected until the installers carry a publisher certificate. It is the reason step 1.3 matters.

The installer registers the Keyward Service (it starts with Windows, under its own account) and puts Keyward Desktop in the notification area. Windows 11 puts a new program's icon under the ^ arrow of the taskbar; drag it onto the taskbar to keep it in sight.

3. Activate

In Keyward Desktop, choose Help › License, enter your license key, and choose Activate. The computer takes one seat of your license, for both programs. You can see your computers, and give a seat back, on your account page. More about seats is in Licenses and seats.

Both programs work without being activated. What activation gives an installation is updates.

4. Keep a first secret

In Keyward Desktop, choose Vault › New project, name it, and add a secret: a name, a value, and the environment it belongs to. The value is encrypted at once under the vault's key and is shown again only through a reveal. Or import: Vault › Import from Credential Manager lists what Windows holds for your account and lets you choose what to bring in.

5. Allow a first caller

The first time a program asks the Service for anything, Keyward Desktop shows who it is (the program's publisher, from its signature) and asks what it may have. For Claude Code, for instance: references to the projects you choose, injection into commands it runs, and a Windows Hello prompt before any reveal. Policy can be changed at any time under Policy.

Then connect the session: claude mcp add keyward -- keyward mcp for Claude Code, codex mcp add keyward -- keyward mcp for Codex, and the Keyward Desktop Extension for Claude Desktop. For git and Docker, see Credential helpers.

Where to go next