Skip to main content
This article explains what the secure token is on macOS, its role in local user management, and why it is required for actions such as changing user passwords or creating new user accounts.

​
What is the secure token?

The secure token is a security identifier generated by macOS and linked to a local user account. It applies to macOS 10.13 and later on APFS volumes. It enables data encryption and decryption through FileVault. A user with a secure token is considered “authorized” to perform sensitive system actions such as:
  • Enabling or disabling FileVault
  • Changing another local user’s password (if the user has a secure token)
  • Creating a new local user
  • Granting a secure token to another account
Without a secure token, these operations fail, even when run from an administrator account. A secure token is granted, not transferred. Several accounts on the same device can hold a secure token at the same time, so you never have to remove one account’s token to give a token to another account.

​
Why the secure token matters

Primo relies on the secure token to manage macOS users securely. When you reset a password or create a new user through Primo, macOS requires an account that holds a secure token to initiate the action. This ensures:
  • Compliance with Apple’s security requirements
  • Continued access to the FileVault-encrypted disk
  • Proper execution of user management actions

​
Check the secure token status from the dashboard

The dashboard displays the secure token status under the Users tab of the relevant device. Use it to verify whether the macOS administrator account used by Primo holds an active secure token.
To ensure proper user management, make sure the administrator account linked to the device has a secure token.
To check the status locally on the device, run:

​
Grant or revoke a secure token

Both commands run locally on the device. To grant a secure token to an account:
To revoke the secure token of an account:
In both cases you need the password of the account concerned and the password of an administrator account that already holds a secure token. This is an Apple requirement: changing the secure token status of a user with sysadminctl always requires the user name and password of an existing secure token–enabled administrator. There is no way to do it remotely without these passwords. You can pass - instead of a password to be prompted for it interactively, which keeps passwords out of your shell history.
Every device must keep at least one account with a secure token. If the last one is revoked, nobody can unlock the disk at startup and the device becomes inaccessible.
Both sysadminctl and System Settings prevent the deletion of the last administrator or secure token–enabled user. The cockpit can take up to 24 hours to update the local account status on the device’s users tab.

​
Bootstrap token and volume ownership

The bootstrap token is the mechanism that lets macOS grant a secure token at first login, without anyone entering credentials manually. Apple documents the following behavior:
  • On macOS 11 and later, setting the initial password for the very first user on the device results in that user being granted a secure token.
  • On macOS 11 and later, if macOS doesn’t grant a secure token at creation, and if a bootstrap token is available from the device management service, it grants a secure token to the local user when they log in.
  • On macOS 10.15.4 and later, macOS generates and escrows a bootstrap token to the device management service on the first login by any secure token–enabled user, if the service supports the feature.
On a device with Apple silicon, the secure token also determines volume ownership, which controls startup security settings and authorizes software updates and erasing all content and settings:
  • The user that first claimed the device by configuring it for their use is granted a secure token and becomes the first volume owner.
  • When a bootstrap token is available and in use, it also becomes a volume owner, and it grants volume ownership status to additional accounts as it grants them secure tokens.
To check volume owners and the bootstrap token state locally:
listUsers returns volume owners by GUID. To map a GUID back to an account, search for its GeneratedUID:

​
Secure token behaviors (macOS only)

​
Troubleshoot secure token issues