<!--
{
  "availability" : [
    "iOS: 9.0.0 -",
    "iPadOS: 9.0.0 -",
    "macCatalyst: 13.1.0 -",
    "macOS: 10.12.1 -",
    "tvOS: 9.0.0 -",
    "visionOS: 1.0.0 -",
    "watchOS: 2.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "Security",
  "identifier" : "/documentation/Security/SecAccessControlCreateFlags/privateKeyUsage",
  "metadataVersion" : "0.1.0",
  "role" : "Type Property",
  "symbol" : {
    "kind" : "Type Property",
    "modules" : [
      "Security"
    ],
    "preciseIdentifier" : "c:@E@SecAccessControlCreateFlags@kSecAccessControlPrivateKeyUsage"
  },
  "title" : "privateKeyUsage"
}
-->

# privateKeyUsage

Enable a private key to be used in signing a block of data or verifying a signed block.

```
static var privateKeyUsage: SecAccessControlCreateFlags { get }
```

## Discussion

This option can be combined with any other access control flags.

You typically use this constraint when you create a key pair and store the private key inside a device’s Secure Enclave (by specifying the [`kSecAttrTokenID`](/documentation/Security/kSecAttrTokenID) attribute with a value of [`kSecAttrTokenIDSecureEnclave`](/documentation/Security/kSecAttrTokenIDSecureEnclave)). This makes the private key available for use in signing and verification tasks that happen inside the Secure Enclave with calls to the [`SecKeyRawSign(_:_:_:_:_:_:)`](/documentation/Security/SecKeyRawSign(_:_:_:_:_:_:)) and [`SecKeyRawVerify(_:_:_:_:_:_:)`](/documentation/Security/SecKeyRawVerify(_:_:_:_:_:_:)) functions. An attempt to use this constraint while generating a key pair outside the Secure Enclave fails. Similarly, an attempt to sign a block with a private key generated without this constraint inside the Secure Enclave fails.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)