On MacOS, I tried using the Password App for passwords, but there is no cli to access it in scripts.

The keychain is accessible with a cli, but is not very nice to work with. Which is a bit sad, because being able to use touchid when running a script or signing commits would be nice.