Glossary/macOS Keychain & security
Touch ID authentication
Touch ID authentication, when used by an app rather than just for unlocking your Mac, requires your fingerprint before that app can reveal a specific piece of protected data, such as a saved password or key. The match itself happens inside the Secure Enclave, not in the app's own code.
Why it matters
This means an app requesting Touch ID cannot fake a successful match or bypass it, since it never receives your fingerprint data at all, only a yes-or-no result from the Secure Enclave.
Is Touch ID stored anywhere as data?
No, your fingerprint data never leaves the Secure Enclave and is not accessible to apps or to Apple.
Can Touch ID be required for every Keychain item?
It depends on how the item was created; some apps opt into requiring it, others rely on the standard Keychain password prompt.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.