Glossary/macOS Keychain & security
Keychain access group
A Keychain access group is a way for multiple apps signed by the same developer to share access to the same Keychain items without the user being prompted for permission every time each app runs, based on a shared identifier declared in each app's entitlements.
Why it matters
Without a shared access group, each app that wants to read another app's Keychain item would need explicit user approval, which is the correct default for apps that have nothing to do with each other.
Can any app join another app's access group?
No, only apps signed with the matching team identifier can be included, which prevents unrelated apps from joining.
Is a Keychain access group a security risk?
Not inherently, it is scoped narrowly to apps the same developer controls and signs.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.