<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/acl-authorization-keys",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "ACL Authorization Keys"
}
-->

# ACL Authorization Keys

The operations an access control list entry applies to.

## Topics

### Constants

[`let kSecACLAuthorizationAny: CFString`](/documentation/Security/kSecACLAuthorizationAny)

No restrictions. This ACL entry applies to all operations available to the caller.

[`let kSecACLAuthorizationLogin: CFString`](/documentation/Security/kSecACLAuthorizationLogin)

Use for a CSP (smart card) login.

[`let kSecACLAuthorizationGenKey: CFString`](/documentation/Security/kSecACLAuthorizationGenKey)

Generate a key.

[`let kSecACLAuthorizationDelete: CFString`](/documentation/Security/kSecACLAuthorizationDelete)

Delete this item.

[`let kSecACLAuthorizationExportWrapped: CFString`](/documentation/Security/kSecACLAuthorizationExportWrapped)

Export a wrapped (that is, encrypted) key. This tag is checked on the key being exported; in addition, the `CSSM_ACL_AUTHORIZATION_ENCRYPT` tag is checked for any key used in the wrapping operation.

[`let kSecACLAuthorizationExportClear: CFString`](/documentation/Security/kSecACLAuthorizationExportClear)

Export an unencrypted key.

[`let kSecACLAuthorizationImportWrapped: CFString`](/documentation/Security/kSecACLAuthorizationImportWrapped)

Import an encrypted key. This tag is checked on the key being imported; in addition, the `CSSM_ACL_AUTHORIZATION_DECRYPT` tag is checked for any key used in the unwrapping operation.

[`let kSecACLAuthorizationImportClear: CFString`](/documentation/Security/kSecACLAuthorizationImportClear)

Import an unencrypted key.

[`let kSecACLAuthorizationSign: CFString`](/documentation/Security/kSecACLAuthorizationSign)

Digitally sign data.

[`let kSecACLAuthorizationEncrypt: CFString`](/documentation/Security/kSecACLAuthorizationEncrypt)

Encrypt data.

[`let kSecACLAuthorizationDecrypt: CFString`](/documentation/Security/kSecACLAuthorizationDecrypt)

Decrypt data.

[`let kSecACLAuthorizationMAC: CFString`](/documentation/Security/kSecACLAuthorizationMAC)

Create or verify a message authentication code.

[`let kSecACLAuthorizationDerive: CFString`](/documentation/Security/kSecACLAuthorizationDerive)

Derive a new key from another key.

[`let kSecACLAuthorizationKeychainCreate: CFString`](/documentation/Security/kSecACLAuthorizationKeychainCreate)

Create a new keychain.

[`let kSecACLAuthorizationKeychainDelete: CFString`](/documentation/Security/kSecACLAuthorizationKeychainDelete)

Delete a keychain.

[`let kSecACLAuthorizationKeychainItemRead: CFString`](/documentation/Security/kSecACLAuthorizationKeychainItemRead)

Read an item from a keychain.

[`let kSecACLAuthorizationKeychainItemInsert: CFString`](/documentation/Security/kSecACLAuthorizationKeychainItemInsert)

Insert an item into a keychain.

[`let kSecACLAuthorizationKeychainItemModify: CFString`](/documentation/Security/kSecACLAuthorizationKeychainItemModify)

Modify an item in a keychain.

[`let kSecACLAuthorizationKeychainItemDelete: CFString`](/documentation/Security/kSecACLAuthorizationKeychainItemDelete)

Delete an item from a keychain.

[`let kSecACLAuthorizationChangeACL: CFString`](/documentation/Security/kSecACLAuthorizationChangeACL)

Change an access control list entry.

[`let kSecACLAuthorizationChangeOwner: CFString`](/documentation/Security/kSecACLAuthorizationChangeOwner)

For internal system use only. Use the `CSSM_ACL_AUTHORIZATION_CHANGE_ACL` tag for changes to owner ACL entries.

[`let kSecACLAuthorizationIntegrity: CFString`](/documentation/Security/kSecACLAuthorizationIntegrity)

[`let kSecACLAuthorizationPartitionID: CFString`](/documentation/Security/kSecACLAuthorizationPartitionID)


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)