Home Blog Handle API keys carefully around Mac clipboard tools

Handle API keys carefully around Mac clipboard tools

Treat the general pasteboard as shared data. NotchDock’s Quick Access list is manually managed and stored through the app’s Keychain helper; it is not an automatic clipboard history or a credential filter.

Know which feature is handling the text

Apple describes NSPasteboard.general as the shared pasteboard used to transfer copied data between apps. NotchDock’s Quick Access widget is a separate, user-managed list of snippets that the reviewed source saves through Keychain APIs. It does not automatically capture every copy action, scan API keys, or promise to recognize password-manager markers.

See Apple’s NSPasteboard documentation. For NotchDock’s local data handling, consult the privacy policy.

Use a low-risk test before trusting a clipboard workflow

  1. Test with a fake token such as test_key_DO_NOT_USE, never a live credential.
  2. Copy and paste it through the exact apps you plan to use. Check whether a clipboard utility or password manager retains it.
  3. Use only controls documented in that app to delete or clear stored snippets; do not assume “clear clipboard” also removes another app’s history.
  4. If a real credential was copied into an unintended tool, revoke or rotate it at the issuing service.

Reduce exposure for real secrets

Prefer your password manager’s autofill or direct integration when available. Avoid putting credentials into shell commands, logs, screenshots, or saved Quick Access snippets. If your workflow requires copying, paste it only into the intended field and follow your organization’s credential-handling policy.

This guide makes no claim that NotchDock filters passwords or provides a one-click clipboard-history purge.