DOCSEARCHbyAlgolia
Submit Docs

Secretive Documentation

repository·main·Indexed 27 days ago

https://github.com/maxgoedjen/secretive

Secretive is a macOS application for protecting and managing SSH keys using the Secure Enclave. It provides hardware-backed security to make private keys non-exportable and supports biometric access control via Touch ID or Apple Watch. The project includes SecretAgentKit for SSH agent protocol implementation, SecretKit for secret management protocols, and SecureEnclaveSecretKit for hardware-isolated key storage.

Tokens
2.4K
Snippets
5
Records
30
Agent score
94%

What's inside Secretive

  1. Overview of Secretive features

    main

    Secretive is an application designed to protect and manage SSH keys using the macOS Secure Enclave. Key features include:

    • Safer Storage: Uses the Secure Enclave to ensure private keys are impossible to export by design.
    • Access Control: Supports strong authentication via Touch ID or Apple Watch before keys can be accessed.
    • Notifications: Provides alerts whenever keys are accessed.
    • Smart Card Support: For Macs without a Secure Enclave, you can configure a Smart Card (e.g., YubiKey) for signing operations.

  6. Import or export Secretive keys

    main
    The Secure Enclave does not allow the import or export of private keys. To use Secretive on a new computer, you must create a new set of keys. Private keys cannot be migrated from one machine to another.

  7. Uninstall Secretive

    main

    To completely remove Secretive from your system:

    1. Drag Secretive.app to the Trash.
    2. Remove the container directory: ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent.

    Note: SecretAgent may continue running in the background until you manually quit it or reboot your Mac.

  9. Manage backups and machine transfers

    main
    Because secrets stored in the Secure Enclave are non-exportable by design, they cannot be backed up or transferred to a new machine. When moving to a new Mac, you must create a new set of secrets specific to that machine.

  10. Use a specific Secretive key in SSH config

    main
    Starting with Secretive 2.2, every secret has an automatically generated public key file on disk. You can find the location of this file under Public Key Path in the Secretive app. To use a specific key, add it to your ~/.ssh/config file.

  11. Configure Secretive for third-party Git clients

    main
    Secretive relies on the SSH_AUTH_SOCK environment variable. While git and ssh command line tools respect this natively, third-party GUI applications may require manual configuration. For specific setup steps for various apps, refer to the secretive-config-instructions repository.

  12. Enable Apple Watch authentication

    main

    To use your Apple Watch to approve key access instead of typing a password, ensure the following:

    1. Enable Use your Apple Watch to unlock apps and your Mac in System Preferences $\rightarrow$ Security & Privacy.
    2. Verify that unlocking your Mac with your Apple Watch is currently functional (lock and unlock your Mac at least once).

    When prompted on the watch, double-click the side button to approve the request.