<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/item-attribute-keys-and-values",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Item attribute keys and values"
}
-->

# Item attribute keys and values

Specify the attributes of keychain items.

## Discussion

In addition to the data that you want to store, keychain items also have attributes that allow you to find them later and that allow you to control how the data is used or shared.

You specify attributes as the keys and values of a dictionary. The available attribute keys are listed below. Typically, the corresponding value is a string, a number, or some other basic type, as given in each key description. In a few cases, the value comes instead from a list of a known constants. These predefined attribute values are also listed below, grouped according to the key that they serve.

> Note:
> Not all attributes apply to every item class. You can find the list of attributes applicable to a given class in the relevant item class value definition, namely in ``doc://com.apple.security/documentation/Security/kSecClassGenericPassword``, ``doc://com.apple.security/documentation/Security/kSecClassInternetPassword``, ``doc://com.apple.security/documentation/Security/kSecClassCertificate``, ``doc://com.apple.security/documentation/Security/kSecClassIdentity``, or ``doc://com.apple.security/documentation/Security/kSecClassKey``.

## Topics

### General Item Attribute Keys

[`let kSecAttrAccess: CFString`](/documentation/Security/kSecAttrAccess)

A key with a value that indicates access control list settings for the item.

[`let kSecAttrAccessControl: CFString`](/documentation/Security/kSecAttrAccessControl)

A key with a value that’s an access control instance indicating access control settings for the item.

[`let kSecAttrAccessible: CFString`](/documentation/Security/kSecAttrAccessible)

A key with a value that indicates when the keychain item is accessible.

[`let kSecAttrAccessGroup: CFString`](/documentation/Security/kSecAttrAccessGroup)

A key with a value that’s a string indicating the access group the item is in.

[`let kSecAttrSynchronizable: CFString`](/documentation/Security/kSecAttrSynchronizable)

A key with a value that’s a string indicating whether the item synchronizes through iCloud.

[`let kSecAttrCreationDate: CFString`](/documentation/Security/kSecAttrCreationDate)

A key with a value that indicates the item’s creation date.

[`let kSecAttrModificationDate: CFString`](/documentation/Security/kSecAttrModificationDate)

A key with a value that indicates the item’s most recent modification date.

[`let kSecAttrDescription: CFString`](/documentation/Security/kSecAttrDescription)

A key with a value that’s a string indicating the item’s description.

[`let kSecAttrComment: CFString`](/documentation/Security/kSecAttrComment)

A key with a value that’s a string indicating a comment associated with the item.

[`let kSecAttrCreator: CFString`](/documentation/Security/kSecAttrCreator)

A key with a value that indicates the item’s creator.

[`let kSecAttrType: CFString`](/documentation/Security/kSecAttrType)

A key with a value that indicates the item’s type.

[`let kSecAttrLabel: CFString`](/documentation/Security/kSecAttrLabel)

A key with a value that’s a string indicating the item’s label.

[`let kSecAttrIsInvisible: CFString`](/documentation/Security/kSecAttrIsInvisible)

A key with a value that’s a Boolean indicating the item’s visibility.

[`let kSecAttrIsNegative: CFString`](/documentation/Security/kSecAttrIsNegative)

A key with a value that’s a Boolean indicating whether the item has a valid password.

[`let kSecAttrSyncViewHint: CFString`](/documentation/Security/kSecAttrSyncViewHint)

A key with a value that’s a string that provides a sync view hint.

[`let kSecAttrPersistantReference: CFString`](/documentation/Security/kSecAttrPersistantReference)

[`let kSecAttrPersistentReference: CFString`](/documentation/Security/kSecAttrPersistentReference)

[`let kSecUseUserIndependentKeychain: CFString`](/documentation/Security/kSecUseUserIndependentKeychain)

A key with a value that indicates whether to store the data in a keychain available to anyone who uses the device.

### Password Attribute Keys

[`let kSecAttrAccount: CFString`](/documentation/Security/kSecAttrAccount)

A key whose value is a string indicating the item’s account name.

[`let kSecAttrService: CFString`](/documentation/Security/kSecAttrService)

A key whose value is a string indicating the item’s service.

[`let kSecAttrGeneric: CFString`](/documentation/Security/kSecAttrGeneric)

A key whose value indicates the item’s user-defined attributes.

[`let kSecAttrSecurityDomain: CFString`](/documentation/Security/kSecAttrSecurityDomain)

A key whose value is a string indicating the item’s security domain.

[`let kSecAttrServer: CFString`](/documentation/Security/kSecAttrServer)

A key whose value is a string indicating the item’s server.

[`let kSecAttrProtocol: CFString`](/documentation/Security/kSecAttrProtocol)

A key whose value indicates the item’s protocol.

[`let kSecAttrAuthenticationType: CFString`](/documentation/Security/kSecAttrAuthenticationType)

A key whose value indicates the item’s authentication scheme.

[`let kSecAttrPort: CFString`](/documentation/Security/kSecAttrPort)

A key whose value indicates the item’s port.

[`let kSecAttrPath: CFString`](/documentation/Security/kSecAttrPath)

A key whose value is a string indicating the item’s path attribute.

### Certificate Attribute Keys

[`let kSecAttrSubject: CFString`](/documentation/Security/kSecAttrSubject)

A key whose value indicates the item’s subject name.

[`let kSecAttrIssuer: CFString`](/documentation/Security/kSecAttrIssuer)

A key whose value indicates the item’s issuer.

[`let kSecAttrSerialNumber: CFString`](/documentation/Security/kSecAttrSerialNumber)

A key whose value indicates the item’s serial number.

[`let kSecAttrSubjectKeyID: CFString`](/documentation/Security/kSecAttrSubjectKeyID)

A key whose value indicates the item’s subject key ID.

[`let kSecAttrPublicKeyHash: CFString`](/documentation/Security/kSecAttrPublicKeyHash)

A key whose value indicates the item’s public key hash.

[`let kSecAttrCertificateType: CFString`](/documentation/Security/kSecAttrCertificateType)

A key whose value indicates the item’s certificate type.

[`let kSecAttrCertificateEncoding: CFString`](/documentation/Security/kSecAttrCertificateEncoding)

A key whose value indicates the item’s certificate encoding.

### Cryptographic Key Attribute Keys

[`let kSecAttrKeyClass: CFString`](/documentation/Security/kSecAttrKeyClass)

A key whose value indicates the item’s cryptographic key class.

[`let kSecAttrApplicationLabel: CFString`](/documentation/Security/kSecAttrApplicationLabel)

A key whose value indicates the item’s application label.

[`let kSecAttrApplicationTag: CFString`](/documentation/Security/kSecAttrApplicationTag)

A key whose value indicates the item’s private tag.

[`let kSecAttrKeyType: CFString`](/documentation/Security/kSecAttrKeyType)

A key whose value indicates the item’s algorithm.

[`let kSecAttrPRF: CFString`](/documentation/Security/kSecAttrPRF)

A key whose value indicates the item’s pseudorandom function.

[`let kSecAttrSalt: CFString`](/documentation/Security/kSecAttrSalt)

A key whose value indicates the salt to use for this item.

[`let kSecAttrRounds: CFString`](/documentation/Security/kSecAttrRounds)

A key whose value indicates the number of rounds to run the pseudorandom function.

[`let kSecAttrKeySizeInBits: CFString`](/documentation/Security/kSecAttrKeySizeInBits)

A key whose value indicates the number of bits in a cryptographic key.

[`let kSecAttrEffectiveKeySize: CFString`](/documentation/Security/kSecAttrEffectiveKeySize)

A key whose value indicates the effective number of bits in a cryptographic key.

[`let kSecAttrTokenID: CFString`](/documentation/Security/kSecAttrTokenID)

A key whose value indicates that a cryptographic key is in an external store.

### Cryptographic Key Usage Attribute Keys

[`let kSecAttrIsPermanent: CFString`](/documentation/Security/kSecAttrIsPermanent)

A key whose value indicates the item’s permanence.

[`let kSecAttrIsSensitive: CFString`](/documentation/Security/kSecAttrIsSensitive)

A key whose value indicates the item’s sensitivity.

[`let kSecAttrIsExtractable: CFString`](/documentation/Security/kSecAttrIsExtractable)

A key whose value indicates the item’s extractability.

[`let kSecAttrCanEncrypt: CFString`](/documentation/Security/kSecAttrCanEncrypt)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for encryption.

[`let kSecAttrCanDecrypt: CFString`](/documentation/Security/kSecAttrCanDecrypt)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for decryption.

[`let kSecAttrCanDerive: CFString`](/documentation/Security/kSecAttrCanDerive)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for derivation.

[`let kSecAttrCanSign: CFString`](/documentation/Security/kSecAttrCanSign)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for digital signing.

[`let kSecAttrCanVerify: CFString`](/documentation/Security/kSecAttrCanVerify)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for signature verification.

[`let kSecAttrCanWrap: CFString`](/documentation/Security/kSecAttrCanWrap)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for wrapping.

[`let kSecAttrCanUnwrap: CFString`](/documentation/Security/kSecAttrCanUnwrap)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for unwrapping.

### Protocol Values

Values you use with the [`let kSecAttrProtocol: CFString`](/documentation/Security/kSecAttrProtocol)

A key whose value indicates the item’s protocol. attribute key.

[`let kSecAttrProtocolFTP: CFString`](/documentation/Security/kSecAttrProtocolFTP)

FTP protocol.

[`let kSecAttrProtocolFTPAccount: CFString`](/documentation/Security/kSecAttrProtocolFTPAccount)

A client side FTP account.

[`let kSecAttrProtocolHTTP: CFString`](/documentation/Security/kSecAttrProtocolHTTP)

HTTP protocol.

[`let kSecAttrProtocolIRC: CFString`](/documentation/Security/kSecAttrProtocolIRC)

IRC protocol.

[`let kSecAttrProtocolNNTP: CFString`](/documentation/Security/kSecAttrProtocolNNTP)

NNTP protocol.

[`let kSecAttrProtocolPOP3: CFString`](/documentation/Security/kSecAttrProtocolPOP3)

POP3 protocol.

[`let kSecAttrProtocolSMTP: CFString`](/documentation/Security/kSecAttrProtocolSMTP)

SMTP protocol.

[`let kSecAttrProtocolSOCKS: CFString`](/documentation/Security/kSecAttrProtocolSOCKS)

SOCKS  protocol.

[`let kSecAttrProtocolIMAP: CFString`](/documentation/Security/kSecAttrProtocolIMAP)

IMAP  protocol.

[`let kSecAttrProtocolLDAP: CFString`](/documentation/Security/kSecAttrProtocolLDAP)

LDAP protocol.

[`let kSecAttrProtocolAppleTalk: CFString`](/documentation/Security/kSecAttrProtocolAppleTalk)

AFP over AppleTalk.

[`let kSecAttrProtocolAFP: CFString`](/documentation/Security/kSecAttrProtocolAFP)

AFP over TCP.

[`let kSecAttrProtocolTelnet: CFString`](/documentation/Security/kSecAttrProtocolTelnet)

Telnet protocol.

[`let kSecAttrProtocolSSH: CFString`](/documentation/Security/kSecAttrProtocolSSH)

SSH protocol.

[`let kSecAttrProtocolFTPS: CFString`](/documentation/Security/kSecAttrProtocolFTPS)

FTP over TLS/SSL.

[`let kSecAttrProtocolHTTPS: CFString`](/documentation/Security/kSecAttrProtocolHTTPS)

HTTP over TLS/SSL.

[`let kSecAttrProtocolHTTPProxy: CFString`](/documentation/Security/kSecAttrProtocolHTTPProxy)

HTTP proxy.

[`let kSecAttrProtocolHTTPSProxy: CFString`](/documentation/Security/kSecAttrProtocolHTTPSProxy)

HTTPS proxy.

[`let kSecAttrProtocolFTPProxy: CFString`](/documentation/Security/kSecAttrProtocolFTPProxy)

FTP proxy.

[`let kSecAttrProtocolSMB: CFString`](/documentation/Security/kSecAttrProtocolSMB)

SMB protocol.

[`let kSecAttrProtocolRTSP: CFString`](/documentation/Security/kSecAttrProtocolRTSP)

RTSP protocol.

[`let kSecAttrProtocolRTSPProxy: CFString`](/documentation/Security/kSecAttrProtocolRTSPProxy)

RTSP proxy.

[`let kSecAttrProtocolDAAP: CFString`](/documentation/Security/kSecAttrProtocolDAAP)

DAAP protocol.

[`let kSecAttrProtocolEPPC: CFString`](/documentation/Security/kSecAttrProtocolEPPC)

Remote Apple Events.

[`let kSecAttrProtocolIPP: CFString`](/documentation/Security/kSecAttrProtocolIPP)

IPP protocol.

[`let kSecAttrProtocolNNTPS: CFString`](/documentation/Security/kSecAttrProtocolNNTPS)

NNTP over TLS/SSL.

[`let kSecAttrProtocolLDAPS: CFString`](/documentation/Security/kSecAttrProtocolLDAPS)

LDAP over TLS/SSL.

[`let kSecAttrProtocolTelnetS: CFString`](/documentation/Security/kSecAttrProtocolTelnetS)

Telnet over TLS/SSL.

[`let kSecAttrProtocolIMAPS: CFString`](/documentation/Security/kSecAttrProtocolIMAPS)

IMAP over TLS/SSL.

[`let kSecAttrProtocolIRCS: CFString`](/documentation/Security/kSecAttrProtocolIRCS)

IRC over TLS/SSL.

[`let kSecAttrProtocolPOP3S: CFString`](/documentation/Security/kSecAttrProtocolPOP3S)

POP3 over TLS/SSL.

### Authentication Type Values

Values you use with the [`let kSecAttrAuthenticationType: CFString`](/documentation/Security/kSecAttrAuthenticationType)

A key whose value indicates the item’s authentication scheme. attribute key.

[`let kSecAttrAuthenticationTypeNTLM: CFString`](/documentation/Security/kSecAttrAuthenticationTypeNTLM)

Windows NT LAN Manager authentication.

[`let kSecAttrAuthenticationTypeMSN: CFString`](/documentation/Security/kSecAttrAuthenticationTypeMSN)

Microsoft Network default authentication.

[`let kSecAttrAuthenticationTypeDPA: CFString`](/documentation/Security/kSecAttrAuthenticationTypeDPA)

Distributed Password authentication.

[`let kSecAttrAuthenticationTypeRPA: CFString`](/documentation/Security/kSecAttrAuthenticationTypeRPA)

Remote Password authentication.

[`let kSecAttrAuthenticationTypeHTTPBasic: CFString`](/documentation/Security/kSecAttrAuthenticationTypeHTTPBasic)

HTTP Basic authentication.

[`let kSecAttrAuthenticationTypeHTTPDigest: CFString`](/documentation/Security/kSecAttrAuthenticationTypeHTTPDigest)

HTTP Digest Access authentication.

[`let kSecAttrAuthenticationTypeHTMLForm: CFString`](/documentation/Security/kSecAttrAuthenticationTypeHTMLForm)

HTML form based authentication.

[`let kSecAttrAuthenticationTypeDefault: CFString`](/documentation/Security/kSecAttrAuthenticationTypeDefault)

The default authentication type.

### Key Class Values

Values you use with the [`let kSecAttrKeyClass: CFString`](/documentation/Security/kSecAttrKeyClass)

A key whose value indicates the item’s cryptographic key class. attribute key.

[`let kSecAttrKeyClassPublic: CFString`](/documentation/Security/kSecAttrKeyClassPublic)

A public key of a public-private pair.

[`let kSecAttrKeyClassPrivate: CFString`](/documentation/Security/kSecAttrKeyClassPrivate)

A private key of a public-private pair.

[`let kSecAttrKeyClassSymmetric: CFString`](/documentation/Security/kSecAttrKeyClassSymmetric)

A private key used for symmetric-key encryption and decryption.

### Key Type Values

Values you use with the [`let kSecAttrKeyType: CFString`](/documentation/Security/kSecAttrKeyType)

A key whose value indicates the item’s algorithm. attribute key.

[`let kSecAttrKeyTypeRSA: CFString`](/documentation/Security/kSecAttrKeyTypeRSA)

RSA algorithm.

[`let kSecAttrKeyTypeDSA: CFString`](/documentation/Security/kSecAttrKeyTypeDSA)

DSA algorithm.

[`let kSecAttrKeyTypeAES: CFString`](/documentation/Security/kSecAttrKeyTypeAES)

AES algorithm.

[`let kSecAttrKeyTypeDES: CFString`](/documentation/Security/kSecAttrKeyTypeDES)

DES algorithm.

[`let kSecAttrKeyType3DES: CFString`](/documentation/Security/kSecAttrKeyType3DES)

3DES algorithm.

[`let kSecAttrKeyTypeRC4: CFString`](/documentation/Security/kSecAttrKeyTypeRC4)

RC4 algorithm.

[`let kSecAttrKeyTypeRC2: CFString`](/documentation/Security/kSecAttrKeyTypeRC2)

RC2 algorithm.

[`let kSecAttrKeyTypeCAST: CFString`](/documentation/Security/kSecAttrKeyTypeCAST)

CAST algorithm.

[`let kSecAttrKeyTypeECDSA: CFString`](/documentation/Security/kSecAttrKeyTypeECDSA)

Elliptic curve DSA algorithm.

[`let kSecAttrKeyTypeEC: CFString`](/documentation/Security/kSecAttrKeyTypeEC)

Elliptic curve algorithm.

[`let kSecAttrKeyTypeECSECPrimeRandom: CFString`](/documentation/Security/kSecAttrKeyTypeECSECPrimeRandom)

Elliptic curve algorithm.

### Synchronizability Values

Values you use with the [`let kSecAttrSynchronizable: CFString`](/documentation/Security/kSecAttrSynchronizable)

A key with a value that’s a string indicating whether the item synchronizes through iCloud. attribute key.

[`let kSecAttrSynchronizableAny: CFString`](/documentation/Security/kSecAttrSynchronizableAny)

Specifies that both synchronizable and non-synchronizable results should be returned from a query.

### Token ID Values

Values you use with the [`let kSecAttrTokenID: CFString`](/documentation/Security/kSecAttrTokenID)

A key whose value indicates that a cryptographic key is in an external store. attribute key.

[`let kSecAttrTokenIDSecureEnclave: CFString`](/documentation/Security/kSecAttrTokenIDSecureEnclave)

Specifies an item should be protected by the device’s Secure Enclave.

### Accessibility Values

Values you use with the [`let kSecAttrAccessible: CFString`](/documentation/Security/kSecAttrAccessible)

A key with a value that indicates when the keychain item is accessible. attribute key, listed from most to least restrictive.

[`let kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly: CFString`](/documentation/Security/kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly)

The data in the keychain can only be accessed when the device is unlocked. Only available if a passcode is set on the device.

[`let kSecAttrAccessibleWhenUnlockedThisDeviceOnly: CFString`](/documentation/Security/kSecAttrAccessibleWhenUnlockedThisDeviceOnly)

The data in the keychain item can be accessed only while the device is unlocked by the user.

[`let kSecAttrAccessibleWhenUnlocked: CFString`](/documentation/Security/kSecAttrAccessibleWhenUnlocked)

The data in the keychain item can be accessed only while the device is unlocked by the user.

[`let kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly: CFString`](/documentation/Security/kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)

The data in the keychain item cannot be accessed after a restart until the device has been unlocked once by the user.

[`let kSecAttrAccessibleAfterFirstUnlock: CFString`](/documentation/Security/kSecAttrAccessibleAfterFirstUnlock)

The data in the keychain item cannot be accessed after a restart until the device has been unlocked once by the user.

[`let kSecAttrAccessibleAlwaysThisDeviceOnly: CFString`](/documentation/Security/kSecAttrAccessibleAlwaysThisDeviceOnly)

The data in the keychain item can always be accessed regardless of whether the device is locked.

[`let kSecAttrAccessibleAlways: CFString`](/documentation/Security/kSecAttrAccessibleAlways)

The data in the keychain item can always be accessed regardless of whether the device is locked.

### Pseudorandom Function Values

Values you use with the [`let kSecAttrPRF: CFString`](/documentation/Security/kSecAttrPRF)

A key whose value indicates the item’s pseudorandom function. attribute key to indicate the item’s pseudorandom function.

[`let kSecAttrPRFHmacAlgSHA1: CFString`](/documentation/Security/kSecAttrPRFHmacAlgSHA1)

Use the SHA1 algorithm.

[`let kSecAttrPRFHmacAlgSHA224: CFString`](/documentation/Security/kSecAttrPRFHmacAlgSHA224)

Use the SHA224 algorithm.

[`let kSecAttrPRFHmacAlgSHA256: CFString`](/documentation/Security/kSecAttrPRFHmacAlgSHA256)

Use the SHA256 algorithm.

[`let kSecAttrPRFHmacAlgSHA384: CFString`](/documentation/Security/kSecAttrPRFHmacAlgSHA384)

Use the SHA384 algorithm.

[`let kSecAttrPRFHmacAlgSHA512: CFString`](/documentation/Security/kSecAttrPRFHmacAlgSHA512)

Use the SHA512 algorithm.

### Access Group Values

Values you use with the [`let kSecAttrAccessGroup: CFString`](/documentation/Security/kSecAttrAccessGroup)

A key with a value that’s a string indicating the access group the item is in. attribute key.

[`let kSecAttrAccessGroupToken: CFString`](/documentation/Security/kSecAttrAccessGroupToken)

The access group containing items provided by external tokens.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)