# Keychain access group

Canonical page: /glossary/keychain-access-group

API keys & secrets glossary, macOS Keychain & security. Keychain Access Group: How Apps Share Keychain Items

**Short answer:** A Keychain access group is a way for multiple apps signed by the same developer to share access to the same Keychain items without the user being prompted for permission every time each app runs, based on a shared identifier declared in each app's entitlements.

## Why it matters

Without a shared access group, each app that wants to read another app's Keychain item would need explicit user approval, which is the correct default for apps that have nothing to do with each other.

## In Claude Keychain

Claude Keychain's GUI app and its MCP server share access to the same Keychain items through this mechanism, so Claude Code can use a secret you added from the app without a separate access prompt for each piece.

## Common questions

**Can any app join another app's access group?**

No, only apps signed with the matching team identifier can be included, which prevents unrelated apps from joining.

**Is a Keychain access group a security risk?**

Not inherently, it is scoped narrowly to apps the same developer controls and signs.

## Related

[macOS Keychain](/glossary/macos-keychain), [Code signing](/glossary/code-signing), [Entitlements (macOS)](/glossary/entitlements)