# kSecAttrTokenID A key whose value indicates that a cryptographic key is in an external store. ``` let kSecAttrTokenID: CFString ``` ## Discussion The corresponding value is of type , and may only be one of the constants specified in [Token ID Values](/documentation/Security/item-attribute-keys-and-values#Token-ID-Values). Presence of this key indicates that the item is backed by an external store, as uniquely identified by the value. An item without this attribute is stored as normal in the keychain database. > Important: > You can’t change this attribute after creating the keychain item. It isn’t possible to migrate existing items between stores. Setting `kSecAttrTokenID` when creating a keychain item in macOS makes it behave like an iOS keychain item, as if ``doc://com.apple.security/documentation/Security/kSecAttrSynchronizable`` were also set. Use this attribute only in the top-level parameter dictionary during key creation and not in one of the private or public key sub-dictionaries given by [`kSecPrivateKeyAttrs`](/documentation/Security/kSecPrivateKeyAttrs) or [`kSecPublicKeyAttrs`](/documentation/Security/kSecPublicKeyAttrs), respectively. For an example, see [Protecting keys with the Secure Enclave](/documentation/Security/protecting-keys-with-the-secure-enclave). --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)