Keychain password
Reads a password from your login keychain into a variable, or saves one to it.
op the keychain item service
Keyboard Maestro: SetVariableToKeychainPassword, SetKeychainPasswordToText
Details #
Uses the macOS login keychain, with generic passwords. get reads through the security command; set writes through the system Keychain API, so the password never appears on a command line. A generic password is found by its service (its name) and, optionally, an account. Use it to keep secrets such as API tokens out of your macros.
get (the default) reads the password and puts it in the variable named by
into. Trailing newlines are removed. The step's trace says the password was read, never what it was.set saves
valueas the password for that service (and account). If one already exists it is updated.
Parameters #
| Parameter | Type | Required | Values | What it does |
|---|---|---|---|---|
service | text | Yes | The password's name. Required. (name is another spelling.) | |
account | text | The account the password is stored under. Optional; if you leave it out, any account of that service matches. | ||
action | one of | get set | Another spelling of op. | |
into | text | For get: the variable that receives the password. | ||
name | text | Another spelling of service. | ||
op | one of | get set | get or set. The default is get. Any other value fails. (action is another spelling.) | |
text | text | Another spelling of value. | ||
value | text | For set: the password text. Required for set. (text is another spelling.) |
Every step also accepts label, onFailure, timeout and dryRunSafe.
Examples #
This one only asks the keychain for an item that very probably does not exist, and the dry run simulates it, so it is safe to try. For real it fails with a clear message if the item is missing:
- Get the keychain item my-api-token
- Show “Token loaded”
Gotchas #
getfails withno keychain password named "X"(addingfor ACCOUNTwhen you gave one) and thesecurityexit code. The first read of an item may also show a macOS prompt asking whether to allow access.setfails with "keychain set needs a value" without a value, and with "couldn't save the keychain password" plus the Security error number otherwise. The trace shows the value of asetas bullets, never the password.The password is held in a variable for the rest of the run and may show in any step that prints it, such as Show message. Don't print it.
Only the login keychain's generic passwords are covered; internet passwords and certificates are not.
Steps that touch the Mac are simulated in a dry run, so nothing is read or saved when you use Try it.