MacOS keychain functions are exposed via the “security “ command line tool. I use this in the terminal to push secrets into a new process’s environment when I d

MacOS keychain functions are exposed via the “security “ command line tool. I use this in the terminal to push secrets into a new process’s environment when I don’t want them to persist in the terminal: > security find-generic-password -a "$USER" -s "PROJECT_OPENAI_API_KEY" -w Ex: > export OPENAI_API_KEY=$(security find-generic-password -a "$USER" -s "PROJECT_OPENAI_API_KEY" -w) llm do-something-cool-thanks-simonw This will pop up a keychain access request (password/biometric prompt) and then inject $USER’s matching “application password” type secret into the child process environment. Note you need to first give the calling app permissions to that secret into Keychain Access, otherwise you will get two password popups (one for the app, then one for the secret usage). I have a function in my zshrc that wraps usage, to save typing.