✓Direct Answer

Oyma stores your private API keys inside Apple's native macOS Keychain Services. Keys are never saved as plain text in configuration files or uploaded to servers, ensuring hardware-level credential protection.

The Risk of Plaintext Credential Storage

Many developer tools and desktop applications store sensitive API credentials in plaintext configuration files (such as .env, config.json, or YAML settings files) located in user home directories. Any rogue script, malicious npm package, or unauthorized process can read these files and compromise expensive API accounts.

Oyma adheres strictly to Apple’s enterprise security architecture by delegating all credential management to macOS Keychain Services.

How Keychain Services Secures Your Keys

When you input a private OpenAI, Anthropic, or OpenRouter API key into Oyma:

  1. Native Keychain Invocation: The application passes the secret directly to the macOS SecItemAdd / SecItemUpdate Keychain API.
  2. Secure Enclave Binding: macOS encrypts the credential using hardware keys managed by the Apple Silicon Secure Enclave.
  3. Application Access Control: Only the cryptographically signed Oyma application binary can read the stored credential. Other local applications cannot read Oyma‘s keychain items without an explicit macOS administrator prompt.
  4. Never Written to Vault: Your API keys are never written to your Markdown vault, never stored in .md frontmatter, and never included in document backups.
User Inputs API Key -> [macOS SecItemAdd API] -> [Hardware Secure Enclave]
                                                         |
                                            (Encrypted Keychain Storage)

Inspecting Your Key in Keychain Access

You can inspect or delete your key at any time using macOS tools:

  • Open Keychain Access (/Applications/Utilities/Keychain Access.app).
  • Search for Oyma.
  • You will see the secure password record stored safely under your Mac user account.

Enterprise Credential Security in macOS Keychain

Protecting third-party API credentials against compromise:

  • Native Keychain Services: Keys are stored using Apple’s official SecItemAdd APIs rather than plaintext config files.
  • Hardware Enclave Encryption: API secrets are encrypted using keys bound to the physical Secure Enclave.
  • Process Access Isolation: Only the cryptographically signed Oyma binary can access stored credentials.
  • Zero Storage in Vault: API keys are never written to Markdown files or included in document backups.

Hardware-Bound Credential Storage in Keychain Services

API keys are stored exclusively in macOS Keychain Services, encrypted by the Apple Silicon Secure Enclave. Secrets are never saved as plaintext in configuration files or included in document backups.

Only the cryptographically signed Oyma application binary can read the stored credentials, preventing other local applications or scripts from accessing your private API keys.

Credential Security Invariants

  • Storage Location: Apple macOS Keychain Services via official SecItemAdd system APIs.
  • Hardware Binding: Encrypted using hardware keys managed by the Apple Silicon Secure Enclave.
  • Process Isolation: Access restricted strictly to the signed Oyma application binary.
  • Vault Hygiene: API keys are never written to Markdown files, frontmatter, or git backups.

Related Questions & Architecture Guides