macotron.keychain

Store API keys, tokens, and other secrets in the macOS login Keychain, so they stay out of plugin source and settings files.

let token = macotron.keychain.get("github-token");
if (!token) {
  token = prompt("GitHub token");
  if (token) macotron.keychain.set("github-token", token);
}

Secrets

Each value is a generic password item under the service io.statico.macotron, with the account macotron.keychain/<file>/<key>. You can see and delete the items in Keychain Access.

get(key: string): string | null

The stored value, or null when there is none.

set(key: string, value: string): void

Stores value, replacing any value already stored under key. A Keychain error is written to the log and not thrown.

delete(key: string): void

Removes the item. Deleting a key that does not exist does nothing.

has(key: string): boolean

Whether a value is stored under key.

Scope

Keys are separate per plugin. Two plugins can both use "github-token" and each sees only its own value. To give several plugins the same key, have each declare a password option, or keep the code in one plugin.

A key stored before Macotron 0.8, under the bare key name, is still found: the first plugin to get() it gets the value, and it is copied into that plugin's own account.

For one plugin's own secret, a password option is usually simpler: the user enters it in Settings and the plugin gets the value from macotron.plugin().