diff --git a/TunnelKit.xcodeproj/project.pbxproj b/TunnelKit.xcodeproj/project.pbxproj
index 2cb2c5a..65ab80d 100644
--- a/TunnelKit.xcodeproj/project.pbxproj
+++ b/TunnelKit.xcodeproj/project.pbxproj
@@ -762,8 +762,8 @@
 		0E05412B25A231D500EFC5FF /* Demo */ = {
 			isa = PBXGroup;
 			children = (
-				0E05413B25A231D500EFC5FF /* macOS */,
 				0E05414325A231D500EFC5FF /* iOS */,
+				0E05413B25A231D500EFC5FF /* macOS */,
 				0E05413225A231D500EFC5FF /* DemoTunnel.plist */,
 				0E05413425A231D500EFC5FF /* Configuration.swift */,
 				0E05413825A231D500EFC5FF /* PacketTunnelProvider.swift */,
@@ -2371,7 +2371,7 @@
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TunnelKit/Demo/macOS/Demo.entitlements;
-				CODE_SIGN_IDENTITY = "-";
+				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
 				DEVELOPMENT_TEAM = DTDYD63ZX9;
@@ -2395,7 +2395,7 @@
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TunnelKit/Demo/macOS/Demo.entitlements;
-				CODE_SIGN_IDENTITY = "-";
+				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
 				DEVELOPMENT_TEAM = DTDYD63ZX9;
@@ -2416,7 +2416,7 @@
 			buildSettings = {
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TunnelKit/Demo/macOS/DemoTunnel.entitlements;
-				CODE_SIGN_IDENTITY = "-";
+				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				DEVELOPMENT_TEAM = DTDYD63ZX9;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -2438,7 +2438,7 @@
 			buildSettings = {
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TunnelKit/Demo/macOS/DemoTunnel.entitlements;
-				CODE_SIGN_IDENTITY = "-";
+				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				DEVELOPMENT_TEAM = DTDYD63ZX9;
 				ENABLE_HARDENED_RUNTIME = YES;
diff --git a/TunnelKit/Demo/iOS/ViewController.swift b/TunnelKit/Demo/iOS/ViewController.swift
index 4978af8..4708def 100644
--- a/TunnelKit/Demo/iOS/ViewController.swift
+++ b/TunnelKit/Demo/iOS/ViewController.swift
@@ -49,6 +49,8 @@ class ViewController: UIViewController, URLSessionDataDelegate {
 
     private let vpn = OpenVPNProvider(bundleIdentifier: tunnelIdentifier)
     
+    private let keychain = Keychain(group: appGroup)
+    
     override func viewDidLoad() {
         super.viewDidLoad()
         
@@ -93,10 +95,12 @@ class ViewController: UIViewController, URLSessionDataDelegate {
 
         let credentials = OpenVPN.Credentials(textUsername.text!, textPassword.text!)
         let cfg = Configuration.make(hostname: hostname, port: port, socketType: socketType)
+        try? keychain.set(password: credentials.password, for: credentials.username, context: tunnelIdentifier)
         let proto = try! cfg.generatedTunnelProtocol(
             withBundleIdentifier: tunnelIdentifier,
             appGroup: appGroup,
-            credentials: credentials
+            context: tunnelIdentifier,
+            username: credentials.username
         )
         let neCfg = NetworkExtensionVPNConfiguration(title: "BasicTunnel", protocolConfiguration: proto, onDemandRules: [])
         vpn.reconnect(configuration: neCfg) { (error) in
diff --git a/TunnelKit/Demo/macOS/ViewController.swift b/TunnelKit/Demo/macOS/ViewController.swift
index 96a5a83..3698a00 100644
--- a/TunnelKit/Demo/macOS/ViewController.swift
+++ b/TunnelKit/Demo/macOS/ViewController.swift
@@ -45,6 +45,8 @@ class ViewController: NSViewController {
     
     private let vpn = OpenVPNProvider(bundleIdentifier: tunnelIdentifier)
 
+    private let keychain = Keychain(group: appGroup)
+    
     override func viewDidLoad() {
         super.viewDidLoad()
         
@@ -84,10 +86,12 @@ class ViewController: NSViewController {
 
         let credentials = OpenVPN.Credentials(textUsername.stringValue, textPassword.stringValue)
         let cfg = Configuration.make(hostname: hostname, port: port, socketType: .udp)
+        try? keychain.set(password: credentials.password, for: credentials.username, context: tunnelIdentifier)
         let proto = try! cfg.generatedTunnelProtocol(
             withBundleIdentifier: tunnelIdentifier,
             appGroup: appGroup,
-            credentials: credentials
+            context: tunnelIdentifier,
+            username: credentials.username
         )
         let neCfg = NetworkExtensionVPNConfiguration(title: "BasicTunnel", protocolConfiguration: proto, onDemandRules: [])
         vpn.reconnect(configuration: neCfg) { (error) in