Skip to content

apwcli

Apple Passwords (iCloud Keychain) from the terminal — and from Python.

Two packages, one repo:

  • apwcli — the CLI: read passwords and one-time codes, save logins, script it all with JSON/TSV output.
  • apwlib — the library underneath: a typed Python API over a managed background daemon.

Why apwcli?

Apple brokers keychain access for third-party browsers through a helper that only runs inside an approved browser — there is no public API. apwcli runs that plumbing for you: a background daemon hosts the iCloud Passwords extension in a headless browser, pairs with the macOS PIN once, and exposes the vault to your terminal, your scripts, and your agents.

  • Passwords & one-time codes — read, save, and update Apple Passwords entries
  • Agent-ready — bundled Claude skill and MCP server (apwcli mcp install)
  • Safe by default — passwords are masked on screen; -c copies to the clipboard instead
  • Scriptable — JSON/TSV output everywhere; Python API via apwlib
  • Zero setup — everything starts and pairs automatically on first use

Install

brew install michel-tricot/tap/apwcli   # or: uv tool install apwcli, pipx install apwcli

For the library only:

uv add apwlib             # or: pip install apwlib

Requires macOS with a supported browser installed (Chrome, Brave, Edge, or Chromium); the iCloud Passwords extension itself is downloaded automatically from the Chrome Web Store.

Quickstart

apwcli pw get github.com                 # saved entries (passwords masked)
apwcli pw get github.com me@example.com -c   # copy one password to the clipboard
apwcli otp get github.com                # current one-time code

The first command sets everything up. If pairing is needed, macOS shows a 6-digit PIN and apwcli prompts for it — that's the whole ceremony. From Python:

from apwlib import ApplePasswords

pw = ApplePasswords(pin_provider=lambda: input("PIN: "))
for entry in pw.get_password("github.com"):
    print(entry.username)

Where next