// HACKER NEWS — CYBERSECURITY
Show HN: macOS data protection keychain for Electron apps
Secure storage for signed Electron and Node apps, backed by the modern macOS Data Protection Keychain.
accounts declares immutable Keychain items; mutableAccounts declares mutable ones. The store
can access their union, while only mutable accounts may be changed or removed. A name belongs in
exactly one list, and either list may be omitted.
The running Electron or Node host must have a valid Apple code signature. By default, the package
uses the host’s bundle identifier as its Keychain service and lets macOS use the host’s private
Keychain access group. No package identity configuration is required.
This package stores generic-password items in macOS's Data Protection Keychain. Its native
implementation uses the SecItem API with kSecUseDataProtectionKeychain: true, rather than the
legacy file-based Keychain used by the older Keychain and SecKeychain APIs. Apple recommends the
Data Protection Keychain for new work because it supports modern access groups, iCloud Keychain,
and biometric access control. See Apple's keychain implementation guidance.
Items created through a legacy file-based Keychain API are not automatically available here; migrate
them explicitly if needed. The security CLI is likewise not an inspection path for this store's
items. Use Keychain Access instead: items appear under Local Items when iCloudSync is false,
or iCloud Keychain when it is true.
An unmodified Electron runtime identifies itself as Electron, so it is not a good namespace for
your app’s development secrets. Instead, run Electron Vite with a cached Electron runtime signed as
a separate development app, such as com.example.product.dev. With no keychainService, the same
openKeychainStore() call then uses that bundle identifier automatically, keeping local values
separate from production.
In the Apple Developer portal, register com.example.product.dev and create a macOS development
provisioning profile for it. Enable Keychain Sharing. The profile must allow this complete access
group:
Replace ABCDE12345 with your Apple Developer Team ID. Xcode can create the profile for you: make
a temporary macOS app target with that bundle identifier, choose your Team, add the Keychain Sharing
capability, and build it once.
Keep this copy in a user cache outside node_modules; recreate it whenever the Electron version,
development certificate, or provisioning profile changes. Create a main entitlement file containing
your complete identifiers and Electron’s normal runtime entitlements:
Sign Electron’s helper apps first. They do not need your Keychain access group; this minimal helper
entitlement file is enough for a standard Electron development runtime: