# Check iCloud Keychain Sync on a Connected Mac Canonical: https://figment.so/blog/icloud-keychain-sync-check iCloud Keychain sync on a Mac involves three separate conditions: the sync toggle, device approval, and app-level access controls. All three must pass before Keychain data is fully available on a connected Mac. The toggle can be on while the Mac is still waiting for device approval. Both can be clear while a helper process is blocked by macOS entitlements or running outside a user login context. Check each layer independently before concluding that Keychain is broken. ## Three Checks, Three Root Causes Most "Keychain not syncing" reports trace back to exactly one of three problems: 1. **Sync is off.** The Passwords sync option in iCloud settings was never enabled, or was later turned off on this Mac. 2. **The device was never approved.** The Mac signed into iCloud and selected "Approve Later" during account setup—approval was never completed. 3. **Helper or app access is blocked.** The sync toggle and approval are both fine, but the process reading Keychain items lacks the correct entitlements, is in the wrong access group, or is running outside a user login context. Each problem has a different fix. Work through them in order. ## Check 1: The Sync Toggle Open **System Settings** from the Apple menu. Click your name, then click **iCloud**. - **macOS Sequoia or later:** Click **Passwords**, then confirm **Sync this Mac** is enabled, then click Done. - **macOS Sonoma and earlier:** Click **Passwords & Keychain**, then confirm **Sync this Mac** is enabled. If the toggle is missing or the section is unavailable, check that two-factor authentication is enabled for the Apple Account and that the Mac is running the latest available software. Apple requires both before iCloud Keychain can be turned on ([Set up iCloud Keychain](https://support.apple.com/en-us/109016)). One edge case worth knowing: if iCloud Keychain was turned off on every device at the same time, Apple removes the cloud copy. Turning the toggle back on creates a fresh vault; previously synced items do not reappear automatically, because iCloud Keychain items are not part of iCloud Backup—they sync directly to iCloud instead ([If iCloud Keychain won't turn on or sync](https://support.apple.com/en-us/102441)). Recovery depends on devices that still hold local copies. ## Check 2: Device Approval Enabling the sync toggle is not the same as being approved to receive Keychain data. When you sign in with an Apple Account on a new Mac, macOS offers an **Approve Later** option during account setup. If that path was taken—and approval was never completed—the Mac is signed into iCloud but Keychain data never syncs down. The Passwords app opens; nothing is in it. A reliable symptom: the toggle appears enabled in iCloud settings, yet the Passwords app on the new Mac shows no credentials while another device on the same account shows a full list. To complete approval ([Set up iCloud Keychain](https://support.apple.com/en-us/109016)): 1. On the new Mac, open System Settings → [Your Name] → iCloud → Passwords. 2. When prompted, approve on another trusted device already enrolled in iCloud Keychain, or enter the old device passcode. 3. After approval, iCloud Keychain begins syncing to the Mac automatically. If no trusted device is available and the old passcode is unknown, Apple's resolution is to reset the end-to-end encrypted data for the account. Keychain data is then rebuilt from devices that still hold local copies. ## Check 3: Helper and App Access macOS controls Keychain access at the app level through access groups and entitlements. Even when sync is on and the device is approved, a process without the correct entitlements cannot read items outside its own access group. Two additional constraints come from the data protection keychain's design ([TN3137: On Mac keychain APIs and implementations](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains)): - The data protection keychain is only available to processes running in a **user login context**—apps and app extensions. A `launchd` daemon runs outside that context and cannot access it. - Access groups available to a process are built from its code-signing entitlements. Those entitlements must be authorized by a provisioning profile embedded in an app-like bundle structure. This applies to any native macOS process—including connector software that runs under the user's account on a connected Mac. The process must run in a user session and carry the right entitlements. See [Grant the Mac Permissions Your Connector Needs](/blog/mac-connector-permissions) for the full checklist. Once iCloud Keychain sync is confirmed and the Mac is set up, check the connection status for any services that depend on a healthy Mac environment—for example, the iMessage service state from your Figment connection. A `syncing` state means data is still downloading; `needs_approval` means device approval (Check 2) is still outstanding. Wait for a `ready` state before treating absent items as a permissions failure. ## What iCloud Keychain Syncs Understanding the scope prevents false alarms during diagnosis. iCloud Keychain syncs across approved Apple devices ([Apple Passwords](https://support.apple.com/en-us/120758)): - Passwords and passkeys saved in Safari and apps—including the associated username for each saved login - Credit card numbers and expiry dates - Wi-Fi network passwords It does **not** sync: - Items stored in the file-based System or login keychains visible in Keychain Access—those live outside the data protection keychain and are not eligible for iCloud sync - Contents of third-party password managers (1Password, Bitwarden, etc.) that maintain their own sync - Passkey private keys via silent or automatic transfer—passkey sign-in runs on the device that holds the key; on OS 26, user-initiated transfer to another participating credential manager is available through system UI, but this is a deliberate user action, not an automatic sync The Passwords app—the primary interface for viewing synced credentials—is available from iOS 18, iPadOS 18, macOS Sequoia, and visionOS 2. On earlier software, passwords appear inside Settings directly. ## If the Checks Pass but Data Is Still Incomplete Initial Keychain sync after approval is not instant. A Mac with no prior history may take several minutes to populate, depending on vault size and network speed. If items are still missing after a few minutes: 1. Confirm the Mac has an active network connection and that iCloud services are not paused. 2. Open the Passwords app—or Settings → Passwords on an iPhone—on a device that already has the data. Verify the items exist there in the first place. A missing item on the new Mac may be a local-only entry that was never synced from the original device. 3. For a connected Mac, re-fetch the connection status for any dependent service and wait for `ready` before treating incomplete data as a configuration error. If the status shows `reconnect_required` or `revoked`, re-establishing the connection from the account management page will trigger a fresh sync sequence. --- When Keychain sync is confirmed, the device is approved, and the connector process has the right entitlements and runs in a user login context, the Mac is ready to work with available credential data within the bounds of its access grant. To connect an Apple Account to your application, visit the [developer registration page](/apple-connect/developers). **Related guides:** - [Grant the Mac Permissions Your Connector Needs](/blog/mac-connector-permissions) - [Fix Missing iMessage History on a Connected Mac](/blog/imessage-history-not-syncing) - [OAuth for iCloud: Connect Apple Data to Your App](/oauth-for-icloud)