Behind the app · Jul 5, 2026
3 min read · Trevor Edwards

Designing a launcher that needs zero permissions

Most Mac launchers ask for Accessibility access on first launch. HyperKey never does - and that constraint shaped the whole architecture.

The first thing a lot of Mac utilities do is ask you to open System Settings and grant Accessibility access. It is a reasonable ask for apps that need to watch every keystroke system-wide or control other applications - but it is also the first moment of friction, and the first moment of trust you are asking someone to extend before they have used your app at all.

An old API, on purpose

HyperKey registers its global hotkey through the Carbon Event Manager rather than a newer, higher-permission API. Carbon hotkey registration does not require Accessibility access, Screen Recording, or Full Disk Access - it is a narrower tool than the alternatives, and that narrowness is exactly what makes the zero-permission launch possible.

It would have been easier, in some ways, to reach for a more modern, more capable API and ask for the permission that comes with it. Capability is not free, though - every permission dialog is a chance for someone to say no, or worse, to say yes without fully understanding what they agreed to.

The rest of the app follows the same rule

App search runs from an in-memory index built at launch. File search hands the query to macOS's own Spotlight index instead of building a parallel one. Neither needs elevated access, because neither reaches past what a completely ordinary app is already allowed to do.

The most trustworthy permission dialog is the one that never has to appear.