Fix repeated Keychain password prompts for Claude Code credentials

If a tool that reads the Claude Code-credentials Keychain item asks for your login password every few hours, the cause is how Claude Code writes that item. This page explains it and lists the fixes.

Why the prompt comes back

Each Keychain item has a partition list: the code-signing Team IDs allowed to read it without a prompt. Clicking Always Allow adds the requesting app to that list for that item only.

Claude Code rewrites its credential item whenever it refreshes the OAuth token, about every eight hours. The rewrite resets the partition list so it trusts only Anthropic's Team ID. Any other app, including a signed and notarized one, is prompted again.

TriggerEffect
Token refresh in Claude CodeItem updated in place, partition list reset
claude /logout then loginItem recreated, no third-party trust
Rebuilding an ad-hoc signed appNew binary hash, earlier grants no longer apply

Inspect the items

Several Claude Code-credentials items can accumulate on one Mac, for example from older Claude Code builds or a renamed user. List the items without reading secrets:

security dump-keychain login.keychain-db | grep -A4 'Claude Code-credentials'

Remove a stale one. This logs Claude Code out if you remove the item in use:

security delete-generic-password -s "Claude Code-credentials" -a "<account>"

Stop the prompts

  1. Open Options → General in Claude Status and keep Keep Claude Code Keychain access working automatically on.
  2. Enter your login keychain password once. It is verified, then stored in a separate Keychain item that only Claude Status reads.
  3. Each refresh cycle, before reading the credential, the app re-adds its own Team ID to the item's partition list using security set-generic-password-partition-list. The password goes to security over standard input, not as a command-line argument visible in ps.

The fix is limited to Claude Code's own credential items. Forget Stored Password in Settings or Diagnostics removes the stored password and turns the feature off.

Use Options → Diagnostics to see every credential entry, which one is in use, and a copy-ready removal command for the others. The pane never shows token values.

Versions before 0.2.4 skipped the automation on Macs whose username is not an email address. Update if you still see prompts.

Install

$ brew tap bcollard/claude-status
$ brew trust --tap bcollard/claude-status
$ brew install --cask claude-status

Questions

Why does macOS keep asking for my Keychain password for Claude Code?

Claude Code rewrites its credential item on each token refresh and resets the item's partition list, so apps that were granted access are prompted again.

Can I stop the prompts without a third-party app?

Not permanently. The partition list can be re-granted with the security command, but it needs the keychain password each time and Claude Code resets it on the next write.

Is it safe to store my keychain password in the app?

It is stored in a dedicated Keychain item created by the app and passed to security over standard input. It can be deleted with Forget Stored Password, and the feature only touches Claude Code's own credential items.

Related guides