# App Sandbox

Canonical page: /glossary/app-sandbox

API keys & secrets glossary, macOS Keychain & security. App Sandbox: What It Restricts on macOS

**Short answer:** The App Sandbox is a macOS security system that restricts what a running app can access by default, such as arbitrary files, other apps' processes, or network resources, unless the app explicitly declares and is granted specific entitlements for them.

## Why it matters

Sandboxing is mandatory for apps distributed through the Mac App Store, which is one reason some categories of developer tool, ones that need to inspect other processes or run arbitrary subprocesses freely, are more often distributed directly.

## In Claude Keychain

Claude Keychain is not sandboxed, since it needs to launch subprocesses with specific environment variables on your behalf, something the standard App Sandbox restricts more tightly than this kind of tool needs.

## Common questions

**Does an unsandboxed app mean less security?**

Not inherently, it means the app relies on code signing, notarization, and its own design instead of the sandbox's automatic restrictions.

**Can a sandboxed app still access the Keychain?**

Yes, Keychain access is available to sandboxed apps through a specific, declared entitlement.

## Related

[Entitlements (macOS)](/glossary/entitlements), [Code signing](/glossary/code-signing), [Notarization (macOS)](/glossary/notarization)