---
title: "Sandboxed Keychain Access"
description: "Configure remote memory credentials when OS keychain access is unavailable."
---

> Documentation Index
> Fetch the complete documentation index at: https://machine-memory.jfa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandboxed Keychain Access

These notes apply to the **remote** memory backend only. For interactive setup and keychain storage, see [`remote setup`](/human/remote/setup).

## Sandboxed environments

Sandboxed environments may not be allowed to interact with the operating system keychain. In that case, provide the remote Worker credentials through a `.env` file at the root of each repository where you use `machine-memory`:

```dotenv
MACHINE_MEMORY_DB_URL=https://your-worker.example/query
MACHINE_MEMORY_DB_TOKEN=your-worker-token
```

`MACHINE_MEMORY_DB_URL` may be the Worker URL or its `/query` endpoint; the CLI normalizes it to the `/query` endpoint.

> Remember: keep `.env` out of version control!

Broader sandbox and MCP-vs-CLI credential notes: [Troubleshooting → Sandbox](/troubleshooting/sandbox).

Source: https://machine-memory.jfa.dev/human/remote/keychain-access/index.mdx