orthanc
Your ~/.aws/config, one click from the console.
Orthanc reads your SSO profiles and puts them in your browser toolbar, in Chrome, Firefox, and Safari. Click a profile, land in the AWS Console signed in to that account and role. Expired session? It runs the device flow for you and keeps going.
$xx.xx one-time · 30-day free trial · no subscription
[profile prod-admin] sso_session = acme sso_account_id = 111122223333 sso_role_name = AdministratorAccess region = us-east-1 [profile staging-dev] sso_session = acme sso_account_id = 444455556666 sso_role_name = PowerUserAccess region = eu-west-1
You know this loop.
Twelve profiles, three SSO sessions, and a token that expires right when you're mid-incident. Orthanc collapses the whole ritual of device authorization, token caching, and federated sign-in URLs into one click on the profile you want.
Interops with the AWS CLI
Tokens are cached in ~/.aws/sso/cache/ in the AWS CLI's own format. Sign in with Orthanc and your terminal's aws commands just work. It goes the other way too.
Multiple sessions, side by side
Open the console for several accounts at once. Orthanc works with the AWS Console's multi-session support, so prod and staging can sit in adjacent tabs.
Session status at a glance
Every profile shows a lit or unlit dot: active or expired. Click through on an expired one and Orthanc triggers the login flow first, then opens the console.
Three steps, then it disappears into your toolbar.
-
Install the app
Get Orthanc from the Mac App Store. It reads the SSO profiles you already have in
~/.aws/config. No accounts, no setup wizard, no importing. -
Get the extension
Add Orthanc to Chrome or Firefox from their stores, or enable the bundled Safari extension. The app wires up the connection for you on first launch.
-
One click to the console
Open the popup, pick a profile, click Open console. Orthanc handles sign-in if needed and opens the AWS Console for that account and role.
Works where you work.
One extension codebase, three stores. The Chrome build runs in every Chromium-based browser.
- Chrome
- Firefox
- Safari
- Brave
- Arc
- Edge
- + other Chromium browsers
Chrome Web Store ↗ Firefox Add-ons ↗ Safari extension ships inside the Mac app.
Credentials never leave your Mac.
Tokens never reach the browser. They stay in the native app on your Mac, in the AWS CLI's own cache; the only thing handed to the extension is a one-time sign-in URL.
- No server in the login path. The app talks directly to AWS's own endpoints (SSO OIDC and federation) from your Mac. We can't see your accounts, sessions, or traffic. There's nothing in between.
- The extension never sees a token. It receives only profile names, session status, and the final one-time-use federated sign-in URL to open in a tab.
- One permission:
nativeMessaging. The extension can't read page content, browsing history, or anything you type. It exists to talk to the app, nothing else. - No accounts, no analytics SDKs, no tracking. There's an optional, anonymous launch ping (a few booleans and version numbers, no identifiers) and you can turn it off in Settings.
The full story, including the one identifier used for trial fraud prevention: privacy policy.
Buy it once. That's the whole model.
Orthanc runs entirely on your Mac. There's no service to rent, so there's no subscription to carry.
$xx.xx one-time
- 30-day free trial: full functionality, starts on first launch, no account needed
- No subscription: a single purchase on the Mac App Store, yours for good
- After the trial: profiles, session status, and SSO login stay free, and the unlock removes the limit on console launches
- Reduced pricing in regions with lower App Store price tiers
Purchases and refunds are handled entirely by Apple. We never see your payment details.
Questions you'd ask before installing.
Why does the extension need a companion app?
Browser extensions can't read ~/.aws/config or perform the SSO device flow safely, and they shouldn't hold your tokens. The native macOS app does all of that locally and hands the extension only the final one-time sign-in URL. That split is the security model, not an inconvenience.
Does it work with static access keys?
No, SSO profiles only. Orthanc is built around AWS IAM Identity Center sessions and temporary credentials. Profiles using aws_access_key_id in ~/.aws/credentials aren't shown.
Will it fight with my AWS CLI sessions?
The opposite: Orthanc caches tokens in ~/.aws/sso/cache/ using the AWS CLI's format. A session started in Orthanc is picked up by aws in your terminal, and a session started with aws sso login shows up as active in the popup.
What do I need to get started?
macOS 26 or later, an AWS account with IAM Identity Center (SSO) configured, and at least one SSO profile in ~/.aws/config. New to this? The AWS CLI's aws configure sso guide walks you through it.
What happens when the trial ends?
Nothing breaks. The popup keeps showing your profiles and session status, SSO login keeps working (your terminal benefits from it too), and console launches move to a limited free allowance until you unlock with the one-time purchase.
Can I open multiple accounts in the console at once?
Yes. With the AWS Console's multi-session support enabled, launching a second profile opens it alongside the first instead of signing you out.
Why the name?
Inside AWS, employees jump between accounts with an internal tool called Isengard, famously the thing Amazonians miss most when they leave. I left AWS, missed it immediately, and decided to build my own.
Isengard is Saruman's fortress. Orthanc is the tower that stands at its center: older than the wizard who occupied it, and unbreakable. It felt right for a tool whose one job is opening the way into your AWS accounts.