Show HN: macOS data protection keychain for Electron apps

Secure storage for signed Electron and Node apps, backed by the modern macOS Data Protection Keychain.

Protect items with code-signing access groups; share only with explicitly entitled apps (no security CLI access)

CLI access) Restrict package access to item names your app declares

Optionally require device-owner authentication (Touch ID or password), or Touch ID only

Store UTF-8 strings and binary values

Install

pnpm add keychain-store

Quick start

import { openKeychainStore } from "keychain-store" ; const store = openKeychainStore ( { // touch ID only authentication : { accessControl : "biometrics-only" } , // build in iCloud sync iCloudSync : true , // support for immutable and mutable accounts accounts : [ "installation-id" ] , mutableAccounts : [ "desktop-token" , "desktop-refresh-token" ] , } ) ; // Uint8Array containing 32 random bytes const installationId = await store . getOrCreate ( "installation-id" ) ; await store . set ( "desktop-token" , "an application token" ) ; // string | null const token = await store . get ( "desktop-token" , "string" ) ; // Uint8Array | null const token = await store . get ( "desktop-token" , "Uint8Array" ) ;

accounts declares immutable Keychain items; mutableAccounts declares mutable ones. The store can access their union, while only mutable accounts may be changed or removed. A name belongs in exactly one list, and either list may be omitted.

... continue reading