macOS Keychain credential security

Storing API credentials in plain text dotfiles or configuration JSON files exposes users to credential harvesting from malicious scripts. Oyma delegates all sensitive credential storage directly to Apple’s native macOS Keychain.

The Security.framework architecture

When you enter an Anthropic or OpenAI API key, Oyma executes Apple’s native Security.framework APIs:

[User Input API Key]
         │
         ▼
[macOS Security.framework (SecItemAdd)]
         │
         ▼
┌──────────────────────────────────────────────┐
│            macOS Login Keychain              │
│       Hardware-Isolated Secure Enclave       │
│           (AES-256 GCM Encryption)          │
└──────────────────────────────────────────────┘

Security properties of Keychain storage

1. Hardware-Backed Encryption: On Apple silicon Macs, Keychain entries are encrypted using keys derived from the Mac’s hardware Secure Enclave.
2. Access Control Lists (ACL): Only the signed, hardened Oyma binary can access its registered Keychain items.
3. Zero Plain Text Artifacts: Backing up your vault via Git or Time Machine never commits your private API keys.

Verifying Keychain entries manually

You can inspect Oyma‘s registered credentials using macOS’s native Keychain Access utility:

1. Open Keychain Access (⌘Space › Keychain Access).
2. Select the login keychain in the left sidebar.
3. Search for Oyma.
4. Inspect the item attributes to confirm the application bundle identifier and encrypted payload.

Related guides

• BYOK overview in Bring your own AI API keys.
• Network verification in Network guard verification and test suite.
• Privacy architecture in Local-only mode.