diff --git a/README.md b/README.md
index c974ef3..d834c07 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ Claude Code → JSON stdin → statusline.sh → formatted status string
 
 Every 60 seconds (configurable), the script calls the Anthropic usage API with your OAuth token. The call takes ~200ms and runs inline — no background processes, no tmux, no scraping.
 
-The OAuth token is read from `~/.claude/.credentials.json`, which Claude Code maintains automatically during active sessions. If the token is expired or the API is unreachable, the script silently falls back to cached data or displays without usage info.
+The OAuth token is read from `~/.claude/.credentials.json`, which Claude Code maintains automatically during active sessions. On macOS, where Claude Code stores credentials in the system Keychain instead of a file, the script falls back to `security find-generic-password -s "Claude Code-credentials" -w`. If the token is expired or the API is unreachable, the script silently falls back to cached data or displays without usage info.
 
 ### About the Usage API
 
@@ -121,7 +121,7 @@ You may have been rate-limited by the Anthropic API (e.g. `REFRESH_INTERVAL` was
 > **Multiple Claude Code windows?** All windows share the same cache file (`~/.claude/usage-exact.json`). Whichever window renders first past the 60s mark will call the API and refresh the cache for all others. You won't get multiple simultaneous API calls from the same machine.
 
 **Usage bars missing?**
-Check that `~/.claude/.credentials.json` exists and contains a valid `claudeAiOauth.accessToken`. This file is created automatically when you log into Claude Code.
+Check that `~/.claude/.credentials.json` exists and contains a valid `claudeAiOauth.accessToken`. This file is created automatically when you log into Claude Code. On macOS, credentials live in the Keychain instead — verify with `security find-generic-password -s "Claude Code-credentials" -w | jq .claudeAiOauth.accessToken`.
 
 **Force a refresh:**
 ```bash
diff --git a/statusline.sh b/statusline.sh
index af834ff..1b62a12 100644
--- a/statusline.sh
+++ b/statusline.sh
@@ -147,9 +147,14 @@ fi
 
 # ── Refresh usage via Anthropic OAuth API ────────────────────────────────────
 refresh_usage_api() {
-    [ ! -f "$CREDENTIALS_FILE" ] && return 1
-    local token
-    token=$(jq -r '.claudeAiOauth.accessToken // empty' "$CREDENTIALS_FILE" 2>/dev/null)
+    local token creds
+    if [ -f "$CREDENTIALS_FILE" ]; then
+        token=$(jq -r '.claudeAiOauth.accessToken // empty' "$CREDENTIALS_FILE" 2>/dev/null)
+    fi
+    if [ -z "$token" ] && command -v security >/dev/null 2>&1; then
+        creds=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null)
+        [ -n "$creds" ] && token=$(printf '%s' "$creds" | jq -r '.claudeAiOauth.accessToken // empty' 2>/dev/null)
+    fi
     [ -z "$token" ] && return 1
     local resp
     resp=$(curl -s --max-time 3 \