MiniUnlockWhat the proposed experience would do
An AI task reaches a login screen and waits. Your phone shows the computer, actual site domain, chosen account and requested action. You approve that one login with phone authentication. A supported browser integration uses the authorized credential for that request and checks whether sign-in completed.
The intended outcome is returning the authentication result to the waiting job. A notification or an accepted credential alone does not prove that the site logged in or that the job continued. Neither this add-on nor that complete workflow is available in the current beta.
Start with supported passwords and TOTP
The first technical candidate is a Mac browser integration plus a phone credential vault. Passwords come from credentials registered by the owner. TOTP support requires registering the relevant account’s authenticator secret through an appropriate setup flow; it does not mean reading another authentication app’s private store.
Each approval must belong to the original site and browser request. Expired, cancelled or redirected requests must not receive credentials. Passwords and authentication codes should stay out of AI chat, model-visible tool arguments and diagnostic logs.
ChatGPT already has a secure sign-in flow
OpenAI documents a secure sign-in form that pauses browser work for credentials and two-factor authentication. Supported password managers can be used on iOS. A MiniUnlock credential provider could be evaluated against this flow, but its compatibility has not been demonstrated.
See OpenAI’s secure sign-in instructions and Apple credential provider extensions. An extension on your office Mac does not automatically control ChatGPT’s cloud browser.
Phone verification and certificate signing need separate integrations
SMS verification, PASS, financial certificates, joint certificates and passkeys have different rules and technical interfaces. Phone authentication in MiniUnlock would not automatically satisfy another service’s required identity verification or electronic signature.
PASS uses its official approval flow. Chrome provides an API for remote WebAuthn processing, making passkeys a separate research candidate. See PASS’s explanation and the Chrome WebAuthn proxy API. These sources do not establish MiniUnlock support.
The release test must include the existing job
A meaningful validation would start with an actual supported site, complete authentication in the original browser session, and verify the waiting task’s next step. It must also test cancellation, request expiry, wrong-domain handling and secret exposure.
Payment, contract signing and other consequential approvals need their actual action details. They should not be disguised as ordinary login requests. Site-specific support and extra user steps will be documented if the add-on reaches release.
Check current availability
Mac and iPhone are in controlled beta. Android and Windows are in development. Public downloads and checkout are not available.
View release statusFrequently asked questions