← Back to research
CLI

KeyEnvy

Store environment secrets in the macOS login Keychain. Give a command the variables you name without adding them to your shell.

Download KeyEnvy for Mac (.zip)
macOS Keychain dialog asking for the login Keychain password before KeyEnvy reads my.product.namespace.

The namespace is one Keychain item. Allow approves this read; Always Allow remembers access for this KeyEnvy executable.

Keep secrets out of the shell

A release script needs a token for one run. Exporting it in a shell profile also gives it to unrelated commands launched from that shell. KeyEnvy stores the value in the login Keychain and supplies it to the command you name:

keyenvy run my.product.namespace RELEASE_TOKEN -- ./scripts/publish

./scripts/publish receives RELEASE_TOKEN in its environment. The calling shell stays unchanged, and KeyEnvy does not print the value. A coding agent can request a named credential without putting its contents in the command or transcript.

One namespace, one read

  1. KeyEnvy requests the Keychain item for my.product.namespace.
  2. macOS applies the item’s access policy and prompts when authorization is needed.
  3. After approval, KeyEnvy reads the item and selects RELEASE_TOKEN.
  4. KeyEnvy replaces itself with ./scripts/publish, adding RELEASE_TOKEN to that process’s environment.
  5. The script and its child processes can use the value. When they exit, that process environment is gone; the stored value remains in Keychain.

Several variables in the same namespace share one Keychain read. KeyEnvy selects the requested names after that read and replaces itself with the command, so signals and exit status belong to the command you launched.

Where access is decided

macOS authorizes KeyEnvy to read the namespace’s Keychain item. KeyEnvy selects the variable names and launches the command after --. That command and its children receive the values; sibling commands and the parent shell do not.

Allow approves one read. Always Allow remembers access for this executable. A nested invocation can use --no-ui to require already-supplied values and avoid another Keychain dialog.

Install and run

Download and unzip the archive, then place keyenvy on your PATH. It includes a signed, notarized universal binary for Apple silicon and Intel Macs, the Objective-C source, and the MIT license. Requires macOS 13 or later.

Version 0.1.1 · SHA-256 f002ea105c295687afe54fefed2b7feba21c88d56bcfabb478a80f2878958b29

Store a single-line value under a project namespace:

keyenvy set my.product.namespace RELEASE_TOKEN

Run a command with the stored value:

keyenvy run my.product.namespace RELEASE_TOKEN -- ./scripts/publish
  • my.product.namespace identifies the Keychain item. Values in the same namespace share one authorization prompt.
  • RELEASE_TOKEN is added to the launched command’s environment. Add more variable names before -- when the command needs more than one.
  • -- marks the start of the command.