I'm adding a Keychain entry programatically onto a machine via the security command as such:

security add-generic-password -a "[email protected]" -s "Exchange" w "P@ssw0rd!" -T "/Applications/Microsoft Outlook"

Screenshot of Keychain entry generated

It looks great, just like one generated one when you set up Outlook! However, I still get the "Microsoft Outlook wants to access key Exchange in your keychain" prompt when the user opens Outlook.

Have I missed a step here somewhere? I was of the impression that -T allowed applications to access a keychain entry unprompted?

  • In addition man says You can remove this default access by explicitly specifying an empty app pathname: -T "" however if I do that it still prompts as well...and if I don't specify any -T it seems all applications can still see and prompt for it... see also openradar.appspot.com/28524119
    – rogerdpack
    Commented Feb 2, 2018 at 21:01

1 Answer 1


In newer versions of OS X you now have to add a partition teamid

security set-generic-password-partition-list -S teamid:UBF8T346G9 -s "Exchange" -k YOUR_USER_PW

If you 'allow' Exchange or whichever app to use the password and then inspect it

security dump-keychain -a > blip.txt

You can see the teamid and then use that in the command above. For instance for Sequel Pro:

    class: "genp"
        0x00000007 <blob>="Sequel Pro : mydb (5180261558162063037)"
        entry 3:
            authorizations (1): partition_id
            description: teamid:Y48LQG59RS
            applications: <null>

Now when you script this trusted password you can use:

    security add-generic-password -a "me@localhost/mydb" -s "my db" -p thepasswordtomydb -T "/Applications/Sequel Pro.app" -U
    security set-generic-password-partition-list -S teamid:Y48LQG59RS -s "my db" -k your_user_pw

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .