Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a way to add applications to a "always allow access"-list for a specific keychain entry. Those applications get read/write permissions to that entry. Is it possible to make keychain only grant readonly access to certain applications?

share|improve this question
up vote 3 down vote accepted

The short answer is no.

This question straddles the line between a general discussion how the API works and how a user can use the tools as written.

The Keychain API only allows access - it's up to the programmer / developer to determine if a read or a write will happen and end users can't realistically change that behavior.

Using the built in Keychain tools and the Keychain app supplied by apple, you can't define a group of apps. You can't even select four or ten apps at once and add them in one step for a specific keychain entry. (The picker for adding apps simply won't allow you to select multiple apps or a folder containing those apps or aliases to those apps you wish to add together.)

The only workarounds would be to write a utility that knows how to handle a group of apps or a folder of apps and iterates over each and calls the keychain API to do the work. There is a basic dictionary or keychain in AppleScript, but it doesn't have any ACL specific commands, so you'll have to dig in the developer documents to see if it's even possible to automate with that tool.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.