Protecting SSH Keys with macOS Secure Enclave

The guide explains how to protect SSH credentials using the macOS Secure Enclave instead of storing an extractable private-key file on disk. The key is generated in hardware, where it cannot be exported; SSH sends authentication challenges to the enclave for signing, and Touch ID can be required for every use. Setup uses macOS’s `sc_auth` command to create a non-exportable P-256 identity, `ssh-keygen` with Apple’s SSH keychain provider to create a usable key handle, and an environment variable to connect SSH to that provider. The public key still goes into a server’s usual `authorized_keys` file, but the unusual key filename must be added explicitly to SSH configuration because automatic discovery does not find it. Touch ID enrollment may need to be reset if key creation fails.

The method provides hardware-backed protection, a visible biometric approval for each SSH operation, and compatibility with standard server-side key management, without requiring another app. It also has practical rough edges: Apple’s authentication dialog identifies a low-level system component rather than SSH, outdated online instructions can point to irrelevant Keychain commands, and a 1Password SSH agent may conflict with the setup. Most importantly, the key is tied to one Mac and cannot be backed up, so a second key on another device or hardware token is needed to preserve access. The author considers the native approach secure and functional but rejects it because of the unattractive prompt, and plans to investigate Secretive instead.