The work happens for you
Proxy
Matchbox uses your provider credential, performs the call and hands back the answer. Your original provider keys stay inside Matchbox.
Matchbox
Access, sized to the task.
Matchbox keeps the credentials your work depends on and performs the operations your team allows, for people, agents and apps. Projects stop carrying provider keys, and each person gets exactly the access their work needs.
How access works
A person, an agent or an app
Asks for the work it needs to do.
Matchbox
Checks who is asking and what your team allows, then does the work.
Original provider keys stay here
The answer comes back
Ready to use, and recorded for the team.
Most work returns as a result. When a tool needs its own way in, Matchbox issues a credential scoped to that task.
- Keeps
- Your provider credentials
- Gives
- Access for one task
- Knows
- Who is asking
- Remembers
- Every allowed call
Three ways to help
However the work needs to be done.
Matchbox looks after your credentials, so nobody has to pass them around.
Scoped access for a tool
Mint
When a tool needs its own way in, Matchbox issues a credential scoped to that task, with its own limits and its own lifetime.
A signature, without the key
Sign
Matchbox signs on your behalf and returns the signed result, so the signing key never has to travel with it.
Every request
A yes, a limit, and a record.
The same four questions before anything reaches a provider.
Who is asking
A person signed in with a passkey, or a Mac enrolled for that person. Signing in on its own never unlocks a provider.
What for
One named task, checked against the access your team has given.
How much
A clear ceiling: how often, how much, and for how long.
What is left behind
A record of who used what, so cost and access have one story.
Custody
One safe place for every credential.
Your team's keys, kept in one vault you control.
Provider credentials live in an encrypted vault inside Matchbox. Nothing needs to be copied into a project, a laptop or an agent, so there is one place to protect and one place to review.
People sign in with a passkey, and each Mac carries its own identity. Requests stay tied to the person and the machine that made them, and access can be withdrawn the moment it is no longer needed.
The console is where your team keeps all of it: people, access, devices, connectors, the record of use, and a credential change when it is time.
Connected
The tools your team already runs.
Access to what you already use, without another round of key sharing.
Repositories
Your code, cloned, reviewed and pushed with the team's own identity.
Hosting
Deploys and rollbacks for the projects you name, without handing out seats.
Advertising and pages
Campaign reads and changes, and publishing to pages your team owns.
Cloud and servers
Scoped cloud actions, and access to the named machines that run your work.
Workspace
Business profiles, opening hours and document work inside your own files.
Archive
Answers and original files from the client archive, cited and limited to the request.
Together
Your team, already recognised.
Soffio and Matchbox share one idea of who belongs.
Soffio lets teammates share knowledge directly, and Matchbox decides which people and machines are part of the team. The two work from the same answer, so nobody has to keep a second list.
That is the shape of the whole stack. Eugeny runs the model on your Mac, Soffio holds what the team knows, and Matchbox holds the access, so the workspace stays local while your credentials stay looked after.
Trusted access
Local work, managed access.
Eugeny runs on the machine in front of you. Matchbox keeps the credentials, answers each allowed request and records it, so your workspace reaches the team's tools without carrying their secrets. The compliance page covers how access and data are governed.
Keep reading.
Three pages that carry the rest of the story.