# Data-protection keychain SecItemAdd in a store-signed TestFlight build > Source-anchored research for Data-protection keychain SecItemAdd in a store-signed TestFlight build. Run status: COMPLETED. Parent: [Apple Platform Publishing (Mac App Store)](https://llms-explorer.com/tree/apple-platform-publishing-mac-app-store/) · 4 facets · 10 facts · page: https://llms-explorer.com/tree/data-protection-keychain-secitemadd-in-a-store-signed-testflight-build/ ## Definitions - On macOS, errSecMissingEntitlement (-34018) means the app requested a keychain access group it is not entitled to use. If SecItemAdd omits kSecAttrAccessGroup, Security uses the app's default group; an explicit group must be among the app's signed access groups. (high confidence) — [source](https://developer.apple.com/documentation/security/errsecmissingentitlement) ## How it works - For native macOS apps, excluding Mac Catalyst and iOS apps running on Mac, SecItem targets the data-protection keychain when a query sets kSecUseDataProtectionKeychain or kSecAttrSynchronizable to true; otherwise it targets the file-based keychain. Data-protection keychain access groups come from code-signing entitlements. (high confidence) — [source](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains) - On macOS, -34018 is errSecMissingEntitlement for a data-protection keychain access group the process is not entitled to use; Apple DTS says this diagnosis does not apply to the traditional file-based keychain. If SecItemAdd omits kSecAttrAccessGroup, it uses the default group. Check the signed app with codesign -d --entitlements :-, not only the project’s .entitlements input. (high confidence) — [source](https://developer.apple.com/forums/thread/114456) ## Problems, failure modes and limitations - A reproducible -34018 error after TestFlight submission is consistent with an effective entitlement or access-group mismatch. Apple DTS recommends checking the built app’s signed entitlements and the access group used by the call; that report does not establish that TestFlight itself uniquely causes the failure. (medium confidence) — [source](https://developer.apple.com/forums/thread/114456) - Hatoba maintainers reported on 2026-10-12 that an ad-hoc signed macOS 27.0 app with no entitlements and TeamIdentifier unset received -34018 from SecItemAdd when targeting the data-protection keychain, including when the add query had no access-control object. This one-project probe shows the error can arise outside TestFlight too. (medium confidence) (verified as of 2026-10-12) — [source](https://github.com/scarletkc/Hatoba/issues/145) ## Facts and statements - In a May 2026 release case, EnviousWispr maintainers found that their Developer ID signed macOS app lacked the keychain-access-groups entitlement; their issue says the shipped app would then return errSecMissingEntitlement on key saves and loads. The release fix added the group entitlement and reported manual signed-release verification, an independent example of a signing-entitlement gap outside TestFlight. (medium confidence) (verified as of 2026-05-25) — [source](https://github.com/saurabhav88/EnviousWispr/issues/845) - For a native macOS target, SecItemAdd defaults to the file-based keychain; set kSecUseDataProtectionKeychain to true in its query, or set kSecAttrSynchronizable to true, to route the call to the data-protection keychain. (high confidence) — [source](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains) - macOS derives a program's data-protection keychain access groups from its code-signing entitlements, and Apple says those entitlements must be authorized by a provisioning profile; TN3125 states that TestFlight builds always require a provisioning profile. (high confidence) (verified as of 2026-10-29) — [source](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains) - Apple's DTS troubleshooting guide says reproducible -34018 errors can occur after TestFlight submission and clarifies that its macOS advice applies to data-protection keychain calls; a TestFlight profile alone therefore does not rule out a missing or mismatched access group. (high confidence) — [source](https://developer.apple.com/forums/thread/114456) - Two separate project reports describe ad-hoc keychain-add failures, but do not test a store-signed TestFlight build: Hatoba reported -34018 for a macOS 27.0.1 ad-hoc probe using userPresence and the data-protection keychain, while Kagisecure reported -34018 for permanent Secure Enclave key additions under ad-hoc and Apple Development signing without a profile. (medium confidence) (verified as of 2026-10-14) — [source](https://github.com/scarletkc/Hatoba/issues/206)