Hmbown/CodeWhale · error · anyhow::Error

Codewhale account login requires an OS credential manager fo

Error message

Codewhale account login requires an OS credential manager for session tokens. Configure Keychain, Credential Manager, or Secret Service and try again. Headless users may explicitly opt into the local 0600 secrets file with {CLOUD_ALLOW_FILE_SESSION_STORE_ENV}=1

What it means

cloud_session_secrets demands an OS-backed secret store (Keychain, Windows Credential Manager, Secret Service) for cloud session tokens. secure_account_session_secrets errors entirely (no OS backend and the file-store opt-in not satisfied), so login is refused before it starts: headless secret hygiene — never silently fall back to a plaintext file.

Source

Thrown at crates/cli/src/cloud.rs:544

        &transport,
        &mut stdout,
        &mut key_reader,
        &mut opener,
        &mut sleeper,
    )
}

fn cloud_session_secrets() -> Result<Secrets> {
    match secure_account_session_secrets() {
        Ok(secrets) => {
            if secrets.backend_name().starts_with("file-based") {
                eprintln!(
                    "warning: OS credential manager unavailable; {CLOUD_ALLOW_FILE_SESSION_STORE_ENV}=1 explicitly enables the local 0600 Codewhale secrets file for cloud session tokens"
                );
            }
            Ok(secrets)
        }
        Err(_) => bail!(
            "Codewhale account login requires an OS credential manager for session tokens. Configure Keychain, Credential Manager, or Secret Service and try again. Headless users may explicitly opt into the local 0600 secrets file with {CLOUD_ALLOW_FILE_SESSION_STORE_ENV}=1"
        ),
    }
}

pub(crate) fn reject_inline_api_key(api_key: Option<&str>) -> Result<()> {
    if api_key.is_some() {
        bail!(
            "`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`"
        );
    }
    Ok(())
}

#[allow(clippy::too_many_arguments)]
fn run_with<T: CloudTransport, W: Write>(
    command: CloudCommand,
    profile: &str,

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Install and start a Secret Service provider (gnome-keyring + libsecret) or ensure Keychain/Credential Manager is available, then retry.
2. For headless use where the risk is accepted, set the file-store opt-in env var to 1 to use the local 0600 secrets file (the code prints its exact name in the warning at line 539).
3. In containers, mount a keyring sidecar or run the login on a workstation and copy nothing — prefer enabling the env opt-in inside the container only.
4. If a keyring exists but is locked, unlock it and retry.

Example fix

# before (headless container)
codewhale account login  # error: requires an OS credential manager

# after (explicit opt-in to 0600 file store)
export CODEWHALE_ALLOW_FILE_SESSION_STORE=1
codewhale account login

// Pre-flight the secret backend before starting login
fn secrets_available() -> bool {
    secure_account_session_secrets().is_ok()
        || std::env::var(CLOUD_ALLOW_FILE_SESSION_STORE_ENV).as_deref() == Ok("1")
}

match cloud_session_secrets() {
    Ok(s) => s,
    Err(e) if e.to_string().contains("OS credential manager") => {
        if headless_and_accepted_risk() {
            std::env::set_var(CLOUD_ALLOW_FILE_SESSION_STORE_ENV, "1");
            cloud_session_secrets() // retry with explicit opt-in
        } else { Err(e) }
    }
    Err(e) => Err(e),
}

When it happens

Trigger: Running `codewhale account login` on a headless Linux box without Secret Service (no D-Bus secret service / gnome-keyring), in minimal containers/WSL without a credential daemon, or SSH sessions where the keyring service is absent and CODEWHALE_ALLOW_FILE_SESSION_STORE (CLOUD_ALLOW_FILE_SESSION_STORE_ENV) is unset.

Common situations: Docker/CI containers, servers without desktop services, WSL distros lacking keyring packages, locked keyrings that fail to open.

Related errors

• The Codewhale service returned an unexpectedly large respons
• Codewhale account login timed out; run `codewhale account lo
• The Codewhale service returned an account without an ID
• Not signed in. Run `codewhale account login` first
• The Codewhale account session expired. Run `codewhale accoun

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/b19fc3e7e314e568. Report an issue: GitHub.