---
title: security add-generic-password on macOS — ezkey.app
description: security add-generic-password writes a login Keychain item. Use -a, -s, prompt for -w, and the login.keychain-db path. ezkey stores the same Name/Where pair.
---

# How do I use security add-generic-password?

`security add-generic-password` writes a generic-password item, usually into the login Keychain. Required ideas: `-a` account, `-s` service (Where), `-w` password. Leave `-w` without a value so the tool prompts, or you will put the secret in shell history. ezkey.app uses the same account (your Mac user) and stores Name as both label and service.

## Flags that matter

| Flag | Meaning | ezkey |

| --- | --- | --- |

| -a | Account | Always the logged-in Mac user; hidden in the UI |

| -s | Service / Where | Same string as Name |

| -l | Label / Name | Same string as Where |

| -w | Password | The secret; prefer a prompt |

| -U | Update if present | Save refuses duplicates until you Update |

| keychain path | Which file | login.keychain-db |

## Add or update

```
security add-generic-password -U -a "$USER" -s "my-app-api-token" -w \
  "$HOME/Library/Keychains/login.keychain-db"
```

ss64 and `man security` document the rest. Creator codes and `-T` trusted apps are how Access Control lists get weird. By default the app that saved an item is trusted and reads it without asking. ezkey saves items with an empty trusted-app list, so every read asks for the login password, ezkey included. That is on purpose: ezkey has no login of its own. Clicking Always Allow does not change this.

A common copy-paste sets `-a` to the service name and `-s` to the key name, or the reverse. Then Keychain Access looks empty when you search the string you remember. Pick a convention and keep it. ezkey’s convention is: the Name you type is both label and service; account is the Mac user. If you already have CLI items with a different account string, Retrieve will not see them until you save under the Mac user or search from Access.

## Find and print

```
security find-generic-password -a "$USER" -s "my-app-api-token" -w \
  "$HOME/Library/Keychains/login.keychain-db"
```

`-w` on find prints only the password. Without it you get attributes. macOS may show a dialog the first time a different app reads the item. For items ezkey saved, it asks every time.

Printing to stdout is a feature and a footgun. Anything that logs the command output now has the secret. Prefer assigning to a variable, passing to the child, and unsetting. `echo $SECRET` in a shared screen session is how keys travel. ezkey’s copy button is the same class of risk for thirty seconds. That is documented, not hidden.

## How this maps to ezkey

If you save `my-app-api-token` in ezkey, Keychain Access shows that string as Name and Where. `security find-generic-password -s my-app-api-token -a "$USER" -w` should print the same secret after you allow access. That round-trip is the point. See [ezkey vs Keychain Access](/compare/ezkey-vs-keychain-access/).

## Related answers

- [How to save API keys securely on a Mac](https://ezkey.app/guides/how-to-save-api-keys-securely-on-mac/): Why the CLI should prompt for -w.
- [Glossary](https://ezkey.app/glossary/): Name, Where, Account.
- [ezkey vs Keychain Access](https://ezkey.app/compare/ezkey-vs-keychain-access/): Same file, different UI.
- [Security](https://ezkey.app/security/): Why ezkey asks for your password every time.

## What is the difference between -s and -l?

-s is service (Where). -l is label (Name). If you omit -l, label defaults to the service. ezkey sets both to the Name you type.

## Why does find fail after I saved in ezkey?

Account must match. ezkey always uses the logged-in username. Pass -a "$USER".

## Can I use -A?

No. -A allows any application to read the item without warning. That is the opposite of careful.

## Does this work over SSH?

Often you will get a prompt you cannot click. File-based Keychain access from SSH is a known pain. ezkey does not fix that.