# How to keep an SSH key in the Mac Secure Enclave and approve each connection with Touch ID, without a separate app

- Link: https://gatezh.com/posts/macos-secure-enclave-ssh-keys/
- Discussion: https://startupxo.com/en/1270/
- Posted by startupxo at 2026-11-11T06:32:58.850Z
- 0 points, 0 comments, kind story, origin curated
- Written in ko, machine translated to en

## Summary

- Instead of a file, the secret key used to connect to servers (the SSH private key) is created inside an isolated security area of the Mac chip (the Secure Enclave). The key never leaves the chip, and the chip signs for each connection.
- It is created with the built-in macOS commands sc_auth and ssh-keygen. The author used the -t bio option to require Touch ID every time the key is used. The post says this is supported on macOS Sequoia and Tahoe.
- The author ran into three problems. The Touch ID enrollment was reset, so key creation failed. The old ssh-add -K instructions did not work. The key path had to be written directly in the SSH config file for the key to be recognized.
- The author decided not to use this method because the Touch ID prompt showed an unfamiliar phrase, ctccardtoken, instead of an SSH message. Instead, the author says they will look into apps that use the Secure Enclave, such as Secretive.

## Sources

- Hacker News: https://news.ycombinator.com/item?id=50449748 (74 points, 22 comments, checked 2026-11-11T06:32:16Z)

## Comments (0)

No comments yet.

JSON: https://startupxo.com/api/v1/item.json?id=1270&lang=en