bk stores new tokens in the system keychain by default
Introduced 2026-03-05 · score 0.95
HOW TO USE IT
When authenticating with `bk`, use its auth commands; new tokens are stored in the system keychain by default. Keep existing `bk.yaml` tokens as read-only fallbacks, or manually add `organizations.<org>.api_token` if config-file storage is required.
bk auth loginbk auth login --org <organization-slug> --token <api-token>organizations:
<organization-slug>:
api_token: <api-token>WHY THIS HELPS
Authenticate with `bk` while preserving existing configuration and credentials.
BEFORE THIS CHANGE
`bk` authentication commands set tokens in the config file.
REQUIREMENTS AND LIMITATIONS
- Version: v3.32.0
- --org <organization-slug>: Organization slug or UUID to request access for; required when using `--token`.
- --token <api-token>: API token to store for non-OAuth login; requires `--org`.
- --credential-store <auto|keyring|shm>: Selects the token credential store. The current docs list `auto`, `keyring`, and `shm`.
- --scopes <scopes>: OAuth scopes to request; current docs say the default requests available REST API scopes.
- organizations.<organization-slug>.api_token: Token value in bk.yaml for that organization; it is read as a fallback and is read-only.
- Prerequisite: The change applies from CLI v3.32.0; the release note says new tokens are stored in the system keychain by default.
- Prerequisite: OAuth login requires an organization with an active plan; the docs say to select a plan, including Free, if the organization has none.
- New tokens are stored in the system keychain by default.
- Config-file token storage requires manually adjusting `bk.yaml`.
- Existing config tokens remain a fallback and are read-only.
- Precedence is environment variable > keychain > config.
- Docs conflict: The current auth reference documents `auto`, `keyring`, and `shm` credential-store choices. It does not establish that all these options behaved the same in v3.32.0.
FIRST-PARTY EVIDENCE
- https://github.com/buildkite/cli/releases/tag/v3.32.0
- https://github.com/buildkite/cli/pull/679
- https://buildkite.com/docs/platform/cli/reference/auth
- https://buildkite.com/resources/changelog/337-improving-authenication-with-the-cli/
- https://buildkite.com/docs/platform/cli/configuration
Check the installed version and the source before using it. Entry JSON