Frequently asked questions
Does Keystone send my data anywhere?
No. Requests go to AWS endpoints using your credentials, or to a local endpoint you configure, and nowhere else. There is no Keystone account and no Keystone server. See the privacy policy for the full picture.
Where are my credentials stored?
In the Apple Keychain. Access keys are never written to a file. With iCloud Keychain on they sync between your Mac and iPad end-to-end encrypted; you can turn that off per connection.
Why do my AWS profiles not show up on the Mac?
The App Store sandbox hides your home folder until you grant access. Settings → Credentials → Grant Access… and choose ~/.aws. You only do it once.
Why did my scan return only 100 items?
Results come in pages. Load Next and Load All are under the grid, and the page size is in Settings. On a big table the pages are what keep the first result fast and cheap.
Why is everything greyed out on this connection?
It is marked as production, so it opened read-only. Unlock writes for the session from the connection badge in the table header. This is deliberate: nobody has ever wished a production table were easier to delete from.
Does Keystone work with DynamoDB Local and LocalStack?
Yes. Choose Local endpoint when adding a connection and press Detect, or type the URL. Any credentials will do.
Does it support IAM Identity Center (SSO)?
Yes, both from an SSO profile in ~/.aws and directly from a start URL. Sign in happens in your browser; tokens are cached and refreshed.
Can I use it with a role I have to assume with MFA?
Yes. Add the role to the connection and Keystone prompts for the code when it needs one.
What happens if I lose the network mid-way through an import?
The writer retries throttled and failed batches with backoff and tells you what was written. DynamoDB writes are per item, so nothing is left half-applied.
Is there an undo?
For item edits made through the editor this session, yes: right-click the row → Revert. Deletes and bulk operations preview exactly what they will touch and ask you to type the table name instead, because there is no undo on the AWS side.
How much does it cost to use?
Keystone itself is a one-time purchase on the App Store. AWS charges for the reads and writes you make, as it would from any client; the status bar shows the consumed capacity of every request so nothing is a surprise.
Which macOS and iPadOS versions are supported?
macOS 14 Sonoma or later, and iPadOS 17 or later.
Does Keystone run on iPhone?
No. The grid and the builder need the room an iPad gives them.
Can I automate opening a table?
Yes: keystone://open?connection=Prod&table=Orders&pk=USER%23123 opens the table and runs the query. Handy from a runbook or an alert.
How do I report a bug?
Email support@tocloco.com with what you expected, what happened, and the entry from the operation log if a request was involved.
Not answered here? support@tocloco.com.