---
tags:
  - macOS
  - Tahoe
  - keychain
  - security
  - passwords
  - command-line
  - security
title: Programmatically Accessing Keychain Items from the Command Line on macOS Tahoe
---

# Programmatically Accessing Keychain Items from the Command Line on macOS Tahoe

While Keychain Access provides a graphical interface, you can also access and manage Keychain items programmatically using the `security` command-line tool. This is useful for scripting and automation.

## The Security Command

The `security` command is a powerful utility for interacting with the macOS Keychain. It is located in `/usr/bin/security`.

## Listing Keychain Items

To see a list of all items in your default keychain:

```zsh
security find-generic-password -g
```

This will prompt you for your password and then display a list of services, account names, and other attributes.

## Finding Specific Items

You can filter the results to find specific items.

### By Service Name

To find a password for a specific website (service):

```zsh
security find-internet-password -s "example.com" -g
```

### By Account Name

To find a password for a specific account:

```zsh
security find-generic-password -a "myusername" -g
```

### Combining Criteria

You can combine criteria to narrow down the search:

```zsh
security find-internet-password -s "example.com" -a "myusername" -g
```

## Getting the Password

To retrieve the actual password, pipe the output of `security` to `awk`:

```zsh
security find-internet-password -s "example.com" -a "myusername" -g 2>&1 | awk '/password: "(.*)"/'
```

## Adding a New Keychain Item

To add a new generic password item to the keychain:

```zsh
security add-generic-password -a "accountName" -s "serviceName" -w "mySecretPassword
```

**Warning**: Storing passwords directly in scripts is highly discouraged due to security risks. Anyone with access to the script can view the password. 

**Alternatives**: 
* Prompt the User: Use a secure input method (e.g., read -s in Zsh) to prompt the user for the password at runtime. 
* Environment Variables: Store the password in an environment variable that is not stored in the script itself. 
* Prompting at Runtime: Consider using `osascript` to prompt the user for a password via a GUI dialog.

## Deleting a Keychain Item

To delete an item from the keychain:

```zsh
security delete-generic-password -a "accountName" -s "serviceName"
```

## Related Guides
*   Managing Passwords with Keychain Access on macOS Tahoe
*   Terminal Basics and Zsh Customization on macOS Tahoe