osx-keychain

Typed OCaml bindings to the macOS Keychain.

GitHub · Opam

Background:

I use an AWS IAM credential to upload this website to S3 and trigger an Amplify deployment. At the moment it's sitting in a dotfile out in the open. I built this library because I'd like to keep the credential in the macOS keychain and have my site generator pull it out of the keychain when it's needed. I could not find a library on opam which provides this functionality.

It's possible to create a subprocess to use the security CLI access, but this introduces subprocess overhead and exposes the secret in the subprocess's standard out. I decided that osx-keychain should instead link directly against the <Security/Security.h> framework's SecItem* APIs and natively read and write secrets.

Example of retrieving a stored password:

Generic_password.get ~service:"my-app" ~account:"alice" ()
|> Result.get_ok
|> Option.iter print_endline

Devlog: