Data-protection keychain SecItemAdd in a store-signed TestFlight build
Parent: Apple Platform Publishing (Mac App Store) · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for Data-protection keychain SecItemAdd in a store-signed TestFlight build. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- On macOS, errSecMissingEntitlement (-34018) means the app requested a keychain access group it is not entitled to use. If SecItemAdd omits kSecAttrAccessGroup, Security uses the app's default group; an explicit group must be among the app's signed access groups. (high confidence) [source]
How it works
- For native macOS apps, excluding Mac Catalyst and iOS apps running on Mac, SecItem targets the data-protection keychain when a query sets kSecUseDataProtectionKeychain or kSecAttrSynchronizable to true; otherwise it targets the file-based keychain. Data-protection keychain access groups come from code-signing entitlements. (high confidence) [source]
- On macOS, -34018 is errSecMissingEntitlement for a data-protection keychain access group the process is not entitled to use; Apple DTS says this diagnosis does not apply to the traditional file-based keychain. If SecItemAdd omits kSecAttrAccessGroup, it uses the default group. Check the signed app with codesign -d --entitlements :-, not only the project’s .entitlements input. (high confidence) [source]
Problems, failure modes and limitations
- A reproducible -34018 error after TestFlight submission is consistent with an effective entitlement or access-group mismatch. Apple DTS recommends checking the built app’s signed entitlements and the access group used by the call; that report does not establish that TestFlight itself uniquely causes the failure. (medium confidence) [source]
- Hatoba maintainers reported on 2026-10-12 that an ad-hoc signed macOS 27.0 app with no entitlements and TeamIdentifier unset received -34018 from SecItemAdd when targeting the data-protection keychain, including when the add query had no access-control object. This one-project probe shows the error can arise outside TestFlight too. (medium confidence) (verified as of 2026-10-12) [source]
Facts and statements
- In a May 2026 release case, EnviousWispr maintainers found that their Developer ID signed macOS app lacked the keychain-access-groups entitlement; their issue says the shipped app would then return errSecMissingEntitlement on key saves and loads. The release fix added the group entitlement and reported manual signed-release verification, an independent example of a signing-entitlement gap outside TestFlight. (medium confidence) (verified as of 2026-05-25) [source]
- For a native macOS target, SecItemAdd defaults to the file-based keychain; set kSecUseDataProtectionKeychain to true in its query, or set kSecAttrSynchronizable to true, to route the call to the data-protection keychain. (high confidence) [source]
- macOS derives a program's data-protection keychain access groups from its code-signing entitlements, and Apple says those entitlements must be authorized by a provisioning profile; TN3125 states that TestFlight builds always require a provisioning profile. (high confidence) (verified as of 2026-10-29) [source]
- Apple's DTS troubleshooting guide says reproducible -34018 errors can occur after TestFlight submission and clarifies that its macOS advice applies to data-protection keychain calls; a TestFlight profile alone therefore does not rule out a missing or mismatched access group. (high confidence) [source]
- Two separate project reports describe ad-hoc keychain-add failures, but do not test a store-signed TestFlight build: Hatoba reported -34018 for a macOS 27.0.1 ad-hoc probe using userPresence and the data-protection keychain, while Kagisecure reported -34018 for permanent Secure Enclave key additions under ad-hoc and Apple Development signing without a profile. (medium confidence) (verified as of 2026-10-14) [source]
Children
- No children recorded.