<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/item-attribute-keys-and-values",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Item attribute keys and values"
}
-->

# Item attribute keys and values

Specify the attributes of keychain items.

## Discussion

In addition to the data that you want to store, keychain items also have attributes that allow you to find them later and that allow you to control how the data is used or shared.

You specify attributes as the keys and values of a dictionary. The available attribute keys are listed below. Typically, the corresponding value is a string, a number, or some other basic type, as given in each key description. In a few cases, the value comes instead from a list of a known constants. These predefined attribute values are also listed below, grouped according to the key that they serve.

> Note:
> Not all attributes apply to every item class. You can find the list of attributes applicable to a given class in the relevant item class value definition, namely in ``doc://com.apple.security/documentation/Security/kSecClassGenericPassword``, ``doc://com.apple.security/documentation/Security/kSecClassInternetPassword``, ``doc://com.apple.security/documentation/Security/kSecClassCertificate``, ``doc://com.apple.security/documentation/Security/kSecClassIdentity``, or ``doc://com.apple.security/documentation/Security/kSecClassKey``.

## Topics

### General Item Attribute Keys

[`kSecAttrAccess`](/documentation/Security/kSecAttrAccess)

A key with a value that indicates access control list settings for the item.

[`kSecAttrAccessControl`](/documentation/Security/kSecAttrAccessControl)

A key with a value that’s an access control instance indicating access control settings for the item.

[`kSecAttrAccessible`](/documentation/Security/kSecAttrAccessible)

A key with a value that indicates when the keychain item is accessible.

[`kSecAttrAccessGroup`](/documentation/Security/kSecAttrAccessGroup)

A key with a value that’s a string indicating the access group the item is in.

[`kSecAttrSynchronizable`](/documentation/Security/kSecAttrSynchronizable)

A key with a value that’s a string indicating whether the item synchronizes through iCloud.

[`kSecAttrCreationDate`](/documentation/Security/kSecAttrCreationDate)

A key with a value that indicates the item’s creation date.

[`kSecAttrModificationDate`](/documentation/Security/kSecAttrModificationDate)

A key with a value that indicates the item’s most recent modification date.

[`kSecAttrDescription`](/documentation/Security/kSecAttrDescription)

A key with a value that’s a string indicating the item’s description.

[`kSecAttrComment`](/documentation/Security/kSecAttrComment)

A key with a value that’s a string indicating a comment associated with the item.

[`kSecAttrCreator`](/documentation/Security/kSecAttrCreator)

A key with a value that indicates the item’s creator.

[`kSecAttrType`](/documentation/Security/kSecAttrType)

A key with a value that indicates the item’s type.

[`kSecAttrLabel`](/documentation/Security/kSecAttrLabel)

A key with a value that’s a string indicating the item’s label.

[`kSecAttrIsInvisible`](/documentation/Security/kSecAttrIsInvisible)

A key with a value that’s a Boolean indicating the item’s visibility.

[`kSecAttrIsNegative`](/documentation/Security/kSecAttrIsNegative)

A key with a value that’s a Boolean indicating whether the item has a valid password.

[`kSecAttrSyncViewHint`](/documentation/Security/kSecAttrSyncViewHint)

A key with a value that’s a string that provides a sync view hint.

[`kSecAttrPersistantReference`](/documentation/Security/kSecAttrPersistantReference)

[`kSecAttrPersistentReference`](/documentation/Security/kSecAttrPersistentReference)

[`kSecUseUserIndependentKeychain`](/documentation/Security/kSecUseUserIndependentKeychain)

A key with a value that indicates whether to store the data in a keychain available to anyone who uses the device.

### Password Attribute Keys

[`kSecAttrAccount`](/documentation/Security/kSecAttrAccount)

A key whose value is a string indicating the item’s account name.

[`kSecAttrService`](/documentation/Security/kSecAttrService)

A key whose value is a string indicating the item’s service.

[`kSecAttrGeneric`](/documentation/Security/kSecAttrGeneric)

A key whose value indicates the item’s user-defined attributes.

[`kSecAttrSecurityDomain`](/documentation/Security/kSecAttrSecurityDomain)

A key whose value is a string indicating the item’s security domain.

[`kSecAttrServer`](/documentation/Security/kSecAttrServer)

A key whose value is a string indicating the item’s server.

[`kSecAttrProtocol`](/documentation/Security/kSecAttrProtocol)

A key whose value indicates the item’s protocol.

[`kSecAttrAuthenticationType`](/documentation/Security/kSecAttrAuthenticationType)

A key whose value indicates the item’s authentication scheme.

[`kSecAttrPort`](/documentation/Security/kSecAttrPort)

A key whose value indicates the item’s port.

[`kSecAttrPath`](/documentation/Security/kSecAttrPath)

A key whose value is a string indicating the item’s path attribute.

### Certificate Attribute Keys

[`kSecAttrSubject`](/documentation/Security/kSecAttrSubject)

A key whose value indicates the item’s subject name.

[`kSecAttrIssuer`](/documentation/Security/kSecAttrIssuer)

A key whose value indicates the item’s issuer.

[`kSecAttrSerialNumber`](/documentation/Security/kSecAttrSerialNumber)

A key whose value indicates the item’s serial number.

[`kSecAttrSubjectKeyID`](/documentation/Security/kSecAttrSubjectKeyID)

A key whose value indicates the item’s subject key ID.

[`kSecAttrPublicKeyHash`](/documentation/Security/kSecAttrPublicKeyHash)

A key whose value indicates the item’s public key hash.

[`kSecAttrCertificateType`](/documentation/Security/kSecAttrCertificateType)

A key whose value indicates the item’s certificate type.

[`kSecAttrCertificateEncoding`](/documentation/Security/kSecAttrCertificateEncoding)

A key whose value indicates the item’s certificate encoding.

### Cryptographic Key Attribute Keys

[`kSecAttrKeyClass`](/documentation/Security/kSecAttrKeyClass)

A key whose value indicates the item’s cryptographic key class.

[`kSecAttrApplicationLabel`](/documentation/Security/kSecAttrApplicationLabel)

A key whose value indicates the item’s application label.

[`kSecAttrApplicationTag`](/documentation/Security/kSecAttrApplicationTag)

A key whose value indicates the item’s private tag.

[`kSecAttrKeyType`](/documentation/Security/kSecAttrKeyType)

A key whose value indicates the item’s algorithm.

[`kSecAttrPRF`](/documentation/Security/kSecAttrPRF)

A key whose value indicates the item’s pseudorandom function.

[`kSecAttrSalt`](/documentation/Security/kSecAttrSalt)

A key whose value indicates the salt to use for this item.

[`kSecAttrRounds`](/documentation/Security/kSecAttrRounds)

A key whose value indicates the number of rounds to run the pseudorandom function.

[`kSecAttrKeySizeInBits`](/documentation/Security/kSecAttrKeySizeInBits)

A key whose value indicates the number of bits in a cryptographic key.

[`kSecAttrEffectiveKeySize`](/documentation/Security/kSecAttrEffectiveKeySize)

A key whose value indicates the effective number of bits in a cryptographic key.

[`kSecAttrTokenID`](/documentation/Security/kSecAttrTokenID)

A key whose value indicates that a cryptographic key is in an external store.

### Cryptographic Key Usage Attribute Keys

[`kSecAttrIsPermanent`](/documentation/Security/kSecAttrIsPermanent)

A key whose value indicates the item’s permanence.

[`kSecAttrIsSensitive`](/documentation/Security/kSecAttrIsSensitive)

A key whose value indicates the item’s sensitivity.

[`kSecAttrIsExtractable`](/documentation/Security/kSecAttrIsExtractable)

A key whose value indicates the item’s extractability.

[`kSecAttrCanEncrypt`](/documentation/Security/kSecAttrCanEncrypt)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for encryption.

[`kSecAttrCanDecrypt`](/documentation/Security/kSecAttrCanDecrypt)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for decryption.

[`kSecAttrCanDerive`](/documentation/Security/kSecAttrCanDerive)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for derivation.

[`kSecAttrCanSign`](/documentation/Security/kSecAttrCanSign)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for digital signing.

[`kSecAttrCanVerify`](/documentation/Security/kSecAttrCanVerify)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for signature verification.

[`kSecAttrCanWrap`](/documentation/Security/kSecAttrCanWrap)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for wrapping.

[`kSecAttrCanUnwrap`](/documentation/Security/kSecAttrCanUnwrap)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for unwrapping.

### Protocol Values

Values you use with the [`kSecAttrProtocol`](/documentation/Security/kSecAttrProtocol)

A key whose value indicates the item’s protocol. attribute key.

[`kSecAttrProtocolFTP`](/documentation/Security/kSecAttrProtocolFTP)

FTP protocol.

[`kSecAttrProtocolFTPAccount`](/documentation/Security/kSecAttrProtocolFTPAccount)

A client side FTP account.

[`kSecAttrProtocolHTTP`](/documentation/Security/kSecAttrProtocolHTTP)

HTTP protocol.

[`kSecAttrProtocolIRC`](/documentation/Security/kSecAttrProtocolIRC)

IRC protocol.

[`kSecAttrProtocolNNTP`](/documentation/Security/kSecAttrProtocolNNTP)

NNTP protocol.

[`kSecAttrProtocolPOP3`](/documentation/Security/kSecAttrProtocolPOP3)

POP3 protocol.

[`kSecAttrProtocolSMTP`](/documentation/Security/kSecAttrProtocolSMTP)

SMTP protocol.

[`kSecAttrProtocolSOCKS`](/documentation/Security/kSecAttrProtocolSOCKS)

SOCKS  protocol.

[`kSecAttrProtocolIMAP`](/documentation/Security/kSecAttrProtocolIMAP)

IMAP  protocol.

[`kSecAttrProtocolLDAP`](/documentation/Security/kSecAttrProtocolLDAP)

LDAP protocol.

[`kSecAttrProtocolAppleTalk`](/documentation/Security/kSecAttrProtocolAppleTalk)

AFP over AppleTalk.

[`kSecAttrProtocolAFP`](/documentation/Security/kSecAttrProtocolAFP)

AFP over TCP.

[`kSecAttrProtocolTelnet`](/documentation/Security/kSecAttrProtocolTelnet)

Telnet protocol.

[`kSecAttrProtocolSSH`](/documentation/Security/kSecAttrProtocolSSH)

SSH protocol.

[`kSecAttrProtocolFTPS`](/documentation/Security/kSecAttrProtocolFTPS)

FTP over TLS/SSL.

[`kSecAttrProtocolHTTPS`](/documentation/Security/kSecAttrProtocolHTTPS)

HTTP over TLS/SSL.

[`kSecAttrProtocolHTTPProxy`](/documentation/Security/kSecAttrProtocolHTTPProxy)

HTTP proxy.

[`kSecAttrProtocolHTTPSProxy`](/documentation/Security/kSecAttrProtocolHTTPSProxy)

HTTPS proxy.

[`kSecAttrProtocolFTPProxy`](/documentation/Security/kSecAttrProtocolFTPProxy)

FTP proxy.

[`kSecAttrProtocolSMB`](/documentation/Security/kSecAttrProtocolSMB)

SMB protocol.

[`kSecAttrProtocolRTSP`](/documentation/Security/kSecAttrProtocolRTSP)

RTSP protocol.

[`kSecAttrProtocolRTSPProxy`](/documentation/Security/kSecAttrProtocolRTSPProxy)

RTSP proxy.

[`kSecAttrProtocolDAAP`](/documentation/Security/kSecAttrProtocolDAAP)

DAAP protocol.

[`kSecAttrProtocolEPPC`](/documentation/Security/kSecAttrProtocolEPPC)

Remote Apple Events.

[`kSecAttrProtocolIPP`](/documentation/Security/kSecAttrProtocolIPP)

IPP protocol.

[`kSecAttrProtocolNNTPS`](/documentation/Security/kSecAttrProtocolNNTPS)

NNTP over TLS/SSL.

[`kSecAttrProtocolLDAPS`](/documentation/Security/kSecAttrProtocolLDAPS)

LDAP over TLS/SSL.

[`kSecAttrProtocolTelnetS`](/documentation/Security/kSecAttrProtocolTelnetS)

Telnet over TLS/SSL.

[`kSecAttrProtocolIMAPS`](/documentation/Security/kSecAttrProtocolIMAPS)

IMAP over TLS/SSL.

[`kSecAttrProtocolIRCS`](/documentation/Security/kSecAttrProtocolIRCS)

IRC over TLS/SSL.

[`kSecAttrProtocolPOP3S`](/documentation/Security/kSecAttrProtocolPOP3S)

POP3 over TLS/SSL.

### Authentication Type Values

Values you use with the [`kSecAttrAuthenticationType`](/documentation/Security/kSecAttrAuthenticationType)

A key whose value indicates the item’s authentication scheme. attribute key.

[`kSecAttrAuthenticationTypeNTLM`](/documentation/Security/kSecAttrAuthenticationTypeNTLM)

Windows NT LAN Manager authentication.

[`kSecAttrAuthenticationTypeMSN`](/documentation/Security/kSecAttrAuthenticationTypeMSN)

Microsoft Network default authentication.

[`kSecAttrAuthenticationTypeDPA`](/documentation/Security/kSecAttrAuthenticationTypeDPA)

Distributed Password authentication.

[`kSecAttrAuthenticationTypeRPA`](/documentation/Security/kSecAttrAuthenticationTypeRPA)

Remote Password authentication.

[`kSecAttrAuthenticationTypeHTTPBasic`](/documentation/Security/kSecAttrAuthenticationTypeHTTPBasic)

HTTP Basic authentication.

[`kSecAttrAuthenticationTypeHTTPDigest`](/documentation/Security/kSecAttrAuthenticationTypeHTTPDigest)

HTTP Digest Access authentication.

[`kSecAttrAuthenticationTypeHTMLForm`](/documentation/Security/kSecAttrAuthenticationTypeHTMLForm)

HTML form based authentication.

[`kSecAttrAuthenticationTypeDefault`](/documentation/Security/kSecAttrAuthenticationTypeDefault)

The default authentication type.

### Key Class Values

Values you use with the [`kSecAttrKeyClass`](/documentation/Security/kSecAttrKeyClass)

A key whose value indicates the item’s cryptographic key class. attribute key.

[`kSecAttrKeyClassPublic`](/documentation/Security/kSecAttrKeyClassPublic)

A public key of a public-private pair.

[`kSecAttrKeyClassPrivate`](/documentation/Security/kSecAttrKeyClassPrivate)

A private key of a public-private pair.

[`kSecAttrKeyClassSymmetric`](/documentation/Security/kSecAttrKeyClassSymmetric)

A private key used for symmetric-key encryption and decryption.

### Key Type Values

Values you use with the [`kSecAttrKeyType`](/documentation/Security/kSecAttrKeyType)

A key whose value indicates the item’s algorithm. attribute key.

[`kSecAttrKeyTypeRSA`](/documentation/Security/kSecAttrKeyTypeRSA)

RSA algorithm.

[`kSecAttrKeyTypeDSA`](/documentation/Security/kSecAttrKeyTypeDSA)

DSA algorithm.

[`kSecAttrKeyTypeAES`](/documentation/Security/kSecAttrKeyTypeAES)

AES algorithm.

[`kSecAttrKeyTypeDES`](/documentation/Security/kSecAttrKeyTypeDES)

DES algorithm.

[`kSecAttrKeyType3DES`](/documentation/Security/kSecAttrKeyType3DES)

3DES algorithm.

[`kSecAttrKeyTypeRC4`](/documentation/Security/kSecAttrKeyTypeRC4)

RC4 algorithm.

[`kSecAttrKeyTypeRC2`](/documentation/Security/kSecAttrKeyTypeRC2)

RC2 algorithm.

[`kSecAttrKeyTypeCAST`](/documentation/Security/kSecAttrKeyTypeCAST)

CAST algorithm.

[`kSecAttrKeyTypeECDSA`](/documentation/Security/kSecAttrKeyTypeECDSA)

Elliptic curve DSA algorithm.

[`kSecAttrKeyTypeEC`](/documentation/Security/kSecAttrKeyTypeEC)

Elliptic curve algorithm.

[`kSecAttrKeyTypeECSECPrimeRandom`](/documentation/Security/kSecAttrKeyTypeECSECPrimeRandom)

Elliptic curve algorithm.

### Synchronizability Values

Values you use with the [`kSecAttrSynchronizable`](/documentation/Security/kSecAttrSynchronizable)

A key with a value that’s a string indicating whether the item synchronizes through iCloud. attribute key.

[`kSecAttrSynchronizableAny`](/documentation/Security/kSecAttrSynchronizableAny)

Specifies that both synchronizable and non-synchronizable results should be returned from a query.

### Token ID Values

Values you use with the [`kSecAttrTokenID`](/documentation/Security/kSecAttrTokenID)

A key whose value indicates that a cryptographic key is in an external store. attribute key.

[`kSecAttrTokenIDSecureEnclave`](/documentation/Security/kSecAttrTokenIDSecureEnclave)

Specifies an item should be stored in the device’s Secure Enclave.

### Accessibility Values

Values you use with the [`kSecAttrAccessible`](/documentation/Security/kSecAttrAccessible)

A key with a value that indicates when the keychain item is accessible. attribute key, listed from most to least restrictive.

[`kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly`](/documentation/Security/kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly)

The data in the keychain can only be accessed when the device is unlocked. Only available if a passcode is set on the device.

[`kSecAttrAccessibleWhenUnlockedThisDeviceOnly`](/documentation/Security/kSecAttrAccessibleWhenUnlockedThisDeviceOnly)

The data in the keychain item can be accessed only while the device is unlocked by the user.

[`kSecAttrAccessibleWhenUnlocked`](/documentation/Security/kSecAttrAccessibleWhenUnlocked)

The data in the keychain item can be accessed only while the device is unlocked by the user.

[`kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`](/documentation/Security/kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)

The data in the keychain item cannot be accessed after a restart until the device has been unlocked once by the user.

[`kSecAttrAccessibleAfterFirstUnlock`](/documentation/Security/kSecAttrAccessibleAfterFirstUnlock)

The data in the keychain item cannot be accessed after a restart until the device has been unlocked once by the user.

[`kSecAttrAccessibleAlwaysThisDeviceOnly`](/documentation/Security/kSecAttrAccessibleAlwaysThisDeviceOnly)

The data in the keychain item can always be accessed regardless of whether the device is locked.

[`kSecAttrAccessibleAlways`](/documentation/Security/kSecAttrAccessibleAlways)

The data in the keychain item can always be accessed regardless of whether the device is locked.

### Pseudorandom Function Values

Values you use with the [`kSecAttrPRF`](/documentation/Security/kSecAttrPRF)

A key whose value indicates the item’s pseudorandom function. attribute key to indicate the item’s pseudorandom function.

[`kSecAttrPRFHmacAlgSHA1`](/documentation/Security/kSecAttrPRFHmacAlgSHA1)

Use the SHA1 algorithm.

[`kSecAttrPRFHmacAlgSHA224`](/documentation/Security/kSecAttrPRFHmacAlgSHA224)

Use the SHA224 algorithm.

[`kSecAttrPRFHmacAlgSHA256`](/documentation/Security/kSecAttrPRFHmacAlgSHA256)

Use the SHA256 algorithm.

[`kSecAttrPRFHmacAlgSHA384`](/documentation/Security/kSecAttrPRFHmacAlgSHA384)

Use the SHA384 algorithm.

[`kSecAttrPRFHmacAlgSHA512`](/documentation/Security/kSecAttrPRFHmacAlgSHA512)

Use the SHA512 algorithm.

### Access Group Values

Values you use with the [`kSecAttrAccessGroup`](/documentation/Security/kSecAttrAccessGroup)

A key with a value that’s a string indicating the access group the item is in. attribute key.

[`kSecAttrAccessGroupToken`](/documentation/Security/kSecAttrAccessGroupToken)

The access group containing items provided by external tokens.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)