macOS Keychain for Grok Bot

The bot tells you a service name and an account name. You save the API key in this Mac’s login keychain. Then you say “saved.” The bot looks it up with security and never needs the secret in chat.

← Tech · AI Agents · GrokBot · PowerLobster · GrokBot tips

What this is

Local MacBook. Login keychain. Grok Bot on this machine. Not SSH, not a Mini, not tmux — that’s /tmux.

Same shape as PowerLobster agent keys: one Keychain item per product, labeled so the bot can find it. Worked example below is BirthdayView (service birthdayview, account bernie.agent). Copy the shape, not someone else’s labels.

One-sentence TL;DR

Don’t paste the key in chat. Add a password item (GUI or read -s + security add-generic-password). Tell the bot “saved.” It runs find with the same -a / -s and does a dry-run until you approve writes.

The labels (this is what must match)

Field	In Keychain Access	In Terminal	Example
Which product	Keychain Item Name	`-s` service	`birthdayview` · `powerlobster`
Which agent	Account Name	`-a` account	`bernie.agent` — not your Mac login, unless the bot said so
The secret	Password	`-w` (from `read -s`, never typed on the line)	paste once, then gone
Which vault	login	default keychain	this Mac, this user session

The bot’s later find-generic-password uses the same -a and -s. If either differs, it will say the item could not be found. Don’t “fix” it by pasting the key into chat.

Option A — Keychain Access (GUI)

Open Keychain Access on this Mac.
File → New Password Item…
Keychain Item Name = the service the bot named (e.g. birthdayview).
Account Name = the agent the bot named (e.g. bernie.agent).
Password = paste the API key once → Add.
If it asks which keychain, choose login.

That’s the whole job. Close the window. Do not screenshot the password field.

Option B — Terminal (key never shows on screen)

This is the command Grok Bot should give you. The read -s prompt hides what you paste. unset KEY drops it from the shell afterward.

read -s -p "BirthdayView API key: " KEY && echo && \
security add-generic-password -a bernie.agent -s birthdayview -w "$KEY" -U -T /usr/bin/security && \
unset KEY && echo "Saved."

Paste, Return, you should see Saved. Swap bernie.agent / birthdayview / the prompt text for whatever the bot named this time (PowerLobster, xAI, …).

read -s — silent paste; the key is not echoed
-U — overwrite if that service+account already exists
-T /usr/bin/security — so the bot’s later find doesn’t need a GUI click every time
Do not put the key after -w on the command line. That hits history.

First time, Keychain may pop Always Allow. Click it. You’re at the laptop; you’ll see the dialog.

Confirm without printing the secret:

security find-generic-password -a bernie.agent -s birthdayview -w | wc -c

Then tell the bot “saved”

That’s the handshake. The bot looks the item up itself:

security find-generic-password -a bernie.agent -s birthdayview -w

It should use the value in-process (e.g. an /api/me check), then dry-run the next action (already-in / propose-add / ignore) and not write until you pick. Same fence as Require Approval.

If find fails, the labels don’t match. Re-add with the exact -a / -s from the bot. Still don’t paste the key into the chat.

Other products, same shape

Service (`-s`)	Account (`-a`)	For
`birthdayview`	`bernie.agent`	BirthdayView API (this worked example)
`powerlobster`	whatever agent handle you used	PowerLobster agent Bearer key
`xai-api`	bot’s label or `$USER`	xAI / Grok HTTP

One item per product. Don’t reuse birthdayview for a different vendor. The bot’s notes should store only the labels.

Rotate

security delete-generic-password -a bernie.agent -s birthdayview
# then Option A or B again

-U on add also overwrites in place.

If it fails

Symptom	Usually
The specified item could not be found	`-a` or `-s` doesn’t match what you saved. Account is the agent name, not your Mac user, unless the bot said so
Permission dialog, then empty	Always Allow, or re-add with `-T /usr/bin/security`
Bot asks you to paste the key in chat	Refuse. Point it at this page. Labels in chat, secret in Keychain
Bot prints the key	Stop. Rotate. Tighten “do not print”

What we keep vs skip

Keep: GUI or read -s; service + agent account labels; login keychain; “saved” handshake; bot find; dry-run before writes; Always Allow once.
Verify: find uses the exact labels the bot will use; Require Approval on BirthdayView / Facebook writes.
Skip: pasting bv_live_… (or any key) into Grok Bot chat; -w the-key on the command line; screenshots of the password field; SSH/Mini as part of this job.

Related on this site

PowerLobster — same “agent gets a key, human doesn’t paste it in chat” idea
GrokBot · Require Approval
Gym hack — a key in Keychain is still a live credential
tmux — different job (another Mac)