Mac VPN keyboard shortcut: Shortcuts vs Automator

One keystroke is enough to start a Mac VPN, and there are two Apple-native ways to bind it. Shortcuts gives each shortcut its own key combination and a menu bar entry. Automator gives you a Quick Action whose key you assign in System Settings, away from the workflow itself. Both routes send the same request to the same connection service, so the differences that matter are where the binding lives, which permission gates you pass through, and what you inspect when the key seems to do nothing.

Everything below assumes an existing system VPN service that appears in scutil --nc list. If your provider ships a third-party client whose connection never shows up there, neither tool can drive it through scutil, and you need that vendor's own action instead.

Both routes call the same service

Start with the list, not with the app. scutil --nc list prints each saved service with its status and its exact display name, which is the string you must quote in the command:

/usr/sbin/scutil --nc start "Office VPN"

That line is an activation request. It returns as soon as the request is accepted; it does not wait for a second factor, report that private DNS is set, or confirm that the file server answers. Treat it as the same click you would make in the menu, minus the menu.

There is also no toggle in scutil. Separate connect and disconnect actions are easier to reason about than one key that flips state, because a flip pressed during a handshake can stop a connection that never finished coming up. If you want a single key, branch on scutil --nc status "Office VPN" output and decide explicitly; do not alternate blindly.

Shortcuts: one key per action, more permission surface

1. Create a local shortcut in Shortcuts and name it after the task, for example Connect Office VPN.

2. Add Run Shell Script and paste the start request, with the service name typed literally rather than pulled from the clipboard or selected text.

3. Run it once from the editor in your own logged-in session and finish the normal authentication flow, so the system records whatever approval it needs.

4. Open the shortcut details and use Add Keyboard Shortcut to bind a combination. Apple documents this binding in its Shortcuts user guide; combinations the system already reserves cannot be taken over.

The binding travels with the shortcut, so one action can also sit in the menu bar or on the Dock without extra work. The price is a second permission: Shortcuts will not run a shell script until scripting is allowed in its preferences, and on a managed Mac that setting may be locked by policy. Allow it for shortcuts you wrote or read, not for an imported file with unclear contents.

Sync is the other trap. A shortcut copied from another Mac still carries that Mac's literal service name. On a machine where the service is named differently the key fires, the script exits, and nothing tells you why.

Automator: fewer moving parts, a key you have to hunt for

1. In Automator choose Quick Action, set the workflow to receive no input in any application, and add Run Shell Script with the same command, shell /bin/zsh.

2. Save it under a name you will recognize in a list, since that name is what you will search for later.

3. Open System Settings, then Keyboard, then Keyboard Shortcuts, then Services. Find the workflow, tick it if it is unticked, and record a combination.

The workflow is invoked as a service, so the key lives in the services table and is keyed by the workflow name. Rename the saved workflow later and you should reopen that panel to confirm the assignment survived. The service shortcut is global, which is convenient until it collides with a combination another app wants.

What you gain is a smaller artifact and one fewer permission prompt: a plain workflow file, no menu bar item of its own, no scripting toggle to argue about. What you lose is discoverability, because the action only appears in the Services list after the workflow has been saved and seen once by the system.

Where they diverge when the key does nothing

The table is lopsided on purpose: in two of its five rows the fix is genuinely different. Most failed keystrokes come down to the same pair of faults, a name that does not match the saved service and a request mistaken for a finished connection, and swapping tools will not cure either one.

Both routes also refuse to store credentials. A key combination cannot turn an interactive login into an unattended one, and pasting a password into a script is a worse idea than typing it once a day.

Choose by these three conditions

Pick Shortcuts when you want a key per action plus menu bar access, and when scripting is already allowed on the machine. Pick Automator when you want one file to copy between Macs and no extra toggle. If your organization locks Shortcuts scripting, the Quick Action is the only one of the two that will run without a policy change, which decides the question for you.

Before you rely on the key, walk this list: confirm the service in scutil --nc list; press the key from a cold start and watch scutil --nc status; open the resource the tunnel exists for; and create a separate, clearly named disconnect action. Do not put the only stop action on a remote session you would need the tunnel to reach.

Next step: bind Connect only, leave Disconnect unbound for a day, and note how often you reach for the menu anyway. That tells you whether the keystroke is saving time or just hiding state.