Skip to content
Okashic Docs

Getting started

Four steps: install, import, connect an agent, and see it work. You need the Okashic app on a device and an agent you already use, like Claude or Hermes.

Okashic is in private beta. Request an invite if you don’t have one yet.

1. Install and create your account

Install the app on Android or macOS. On first run you create an account and set a primary password — the one password you remember. It signs you in and unlocks the vault, and there is no separate account password.

Your primary password never leaves your device in readable form. The app derives a verifier from it to sign you in, and derives the vault key from it on the device to unlock your records. The server sees the verifier, never the password or the key.

You can turn on biometric unlock so a fingerprint or face unlocks the vault without retyping the primary password. The password stays the fallback.

2. Bring your logins in

Import from your current password manager — 1Password, Bitwarden, and other formats — so you don’t retype anything. Import maps each item onto an Okashic record and its type.

From here, autofill works the way you expect: the app fills logins and forms, and offers to save new credentials as you use them. This is also how context keeps entering the vault.

3. Connect an agent

Each agent identifies itself to Okashic with its own API key. Create a key for the agent, then point the agent’s MCP client at your local broker — it serves MCP at http://127.0.0.1:8765/mcp, and the agent authenticates with the key as a bearer token. The broker ships inside the macOS and Android apps, and as a headless Linux broker for agents that run on a server.

Agents & MCP is the step-by-step: create the agent, paste the MCP config, give it a connection, and run a prompt that confirms the whole path works. To stand up the server broker first, see Run the headless broker.

Revoke the key at any time to cut that agent off — the change takes effect immediately.

4. Connect a service and see it work

An agent can read your vault context, but to act on an outside service it needs a connection. You create one once, in Okashic:

  • Website sign-in — a site you log into. The broker holds the session for your agent.
  • API token or OAuth — a service you reach with a token or an OAuth sign-in, like Google or GitHub. Responses are filtered to the fields the task needs.
  • No credential — a public API that needs no secret.
  • Custom (REST) — any other REST API you set up yourself.

An agent can ask for a connection, but only you can create one. With a calendar and a weather service connected, your agent can assemble a daily brief, and every step shows up in your audit log.