Secure Enclave SSH Keys on macOS 26
1 minute read •
Secretive was long the standard tool for generating and storing SSH keys in the Secure Enclave, keeping the private key isolated on hardware and requiring Touch ID for each signing operation. In macOS 26, this capability is built directly into the operating system through sc_auth and /usr/lib/ssh-keychain.dylib.
For detailed setup instructions, see Native Secure Enclave SSH Keys (the macOS guide) or this quick gist. Apple also details the underlying CryptoTokenKit APIs in Protecting keys with the Secure Enclave.