Keychain: what to store in it and how to work with it?
The gist
The Keychain is an encrypted system store for small secrets: access/refresh tokens, passwords, encryption keys, an identifier that must survive a reinstall. Items are encrypted with keys tied to the device and the passcode, and access goes through a system daemon over IPC. It is slower than UserDefaults, so values are read on demand and kept in memory.
What does not belong in the Keychain: large data and caches (encrypt the file and keep the key in the Keychain), non-secret settings, and secrets that should not be on the client at all: an API key embedded in the app can be extracted from the binary no matter how it is stored.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep