{
  "slug": "bk-stores-new-tokens-in-the-system-keychain-by-default-7b4efcb11be0",
  "title": "bk stores new tokens in the system keychain by default",
  "tools": [
    "bk"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-03-05T23:02:22.000Z",
  "announced_at": "2026-03-05T23:02:22.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When authenticating with `bk`, use its auth commands; new tokens are stored in the system keychain by default. Keep existing `bk.yaml` tokens as read-only fallbacks, or manually add `organizations.<org>.api_token` if config-file storage is required.",
    "examples": [
      "bk auth login",
      "bk auth login --org <organization-slug> --token <api-token>",
      "organizations:\n  <organization-slug>:\n    api_token: <api-token>"
    ],
    "gotchas": [
      "Version: v3.32.0",
      "--org <organization-slug>: Organization slug or UUID to request access for; required when using `--token`.",
      "--token <api-token>: API token to store for non-OAuth login; requires `--org`.",
      "--credential-store <auto|keyring|shm>: Selects the token credential store. The current docs list `auto`, `keyring`, and `shm`.",
      "--scopes <scopes>: OAuth scopes to request; current docs say the default requests available REST API scopes.",
      "organizations.<organization-slug>.api_token: Token value in bk.yaml for that organization; it is read as a fallback and is read-only.",
      "Prerequisite: The change applies from CLI v3.32.0; the release note says new tokens are stored in the system keychain by default.",
      "Prerequisite: OAuth login requires an organization with an active plan; the docs say to select a plan, including Free, if the organization has none.",
      "New tokens are stored in the system keychain by default.",
      "Config-file token storage requires manually adjusting `bk.yaml`.",
      "Existing config tokens remain a fallback and are read-only.",
      "Precedence is environment variable > keychain > config.",
      "Docs conflict: The current auth reference documents `auto`, `keyring`, and `shm` credential-store choices. It does not establish that all these options behaved the same in v3.32.0."
    ]
  },
  "why_it_matters": "Authenticate with `bk` while preserving existing configuration and credentials.",
  "before": "`bk` authentication commands set tokens in the config file.",
  "sources": [
    "https://github.com/buildkite/cli/releases/tag/v3.32.0",
    "https://github.com/buildkite/cli/pull/679",
    "https://buildkite.com/docs/platform/cli/reference/auth",
    "https://buildkite.com/resources/changelog/337-improving-authenication-with-the-cli/",
    "https://buildkite.com/docs/platform/cli/configuration"
  ],
  "rank": 0.95055,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3-rejudge+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-7c6ad1b1e730795b-0:rescue",
    "evidence_hash": "39187495f37410d2c6e64ec7246dff147955cd395a688581777ab86d4f23cd5b"
  },
  "review": {
    "draft_hash": "8129d5d519e6f6d8fe96ac5dfb59e501b3ebe6f20371f39246812357849813fa",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:rescue",
    "reason": "Rescue path: first rejected only because the extracted card lacked usage; judged again on the enriched card, 3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.95 >= 0.9; 2 needed) and Jev gave 0.70 (>= 0.6 needed)."
  }
}