sincecutoff.com
/v1/json /v1/md llms.txt
← all changes

wrangler stores OAuth credentials in the OS keychain

Introduced 2026-07-02 · score 0.90

HOW TO USE IT

When Wrangler OAuth credentials should be encrypted at rest, run `wrangler login --use-keyring` to store them in an encrypted file with its key in the OS keychain; existing plaintext credentials migrate on first opt-in.

npx wrangler login --use-keyring
CLOUDFLARE_AUTH_USE_KEYRING=true npx wrangler deploy
npx wrangler login --no-use-keyring

WHY THIS HELPS

Opt into encrypted OAuth credential storage when authenticating Wrangler on a development machine or CI runner.

BEFORE THIS CHANGE

Wrangler stored OAuth access and refresh tokens in a plaintext TOML file by default.

REQUIREMENTS AND LIMITATIONS

  • Version: 4.107.0
  • Requires Windows lazily installs `@napi-rs/keyring` (~1.9 MB) on first opt-in; Linux requires `secret-tool` from `libsecret-tools`.
  • --use-keyring: Store OAuth credentials in an encrypted file with the encryption key in the OS keychain; persists the choice.
  • --no-use-keyring: Opt out; deletes encrypted credentials and the keychain entry.
  • CLOUDFLARE_AUTH_USE_KEYRING: Set to `true` or `false` to override the saved preference for one invocation.
  • Prerequisite: macOS uses `/usr/bin/security`; Linux requires `secret-tool` from the `libsecret-tools` package. Windows uses `@napi-rs/keyring`, installed lazily on opt-in; for non-interactive environments, install it ahead of time with `npm install -g @napi-rs/keyring@<version>`.
  • Prerequisite: Wrangler CLI and an OAuth login flow are required for `wrangler login`; Wrangler recommends installing it locally in the project.
  • Keyring storage is opt-in; plaintext-file storage remains the default.
  • Opting out deletes encrypted credentials instead of decrypting them back to disk, so re-authentication is required.
  • The preference applies to every auth profile; each named profile gets its own encrypted file and key.
  • Windows errors with instructions in non-interactive/CI contexts when keyring support is first opted into.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card