aaif-goose/goose · error

Failed to store secret

Error message

Failed to store secret

What it means

When adding environment variables during `goose configure`, each key/value pair is persisted through try_store_secret, which delegates to the OS secret store/keyring. If storing reports failure, the entry loop aborts with this generic message.

Source

Thrown at crates/goose-cli/src/commands/configure.rs:1135

    let envs = HashMap::new();
    let mut env_keys = Vec::new();
    let config = Config::global();

    if !cliclack::confirm("Would you like to add environment variables?").interact()? {
        return Ok((envs, env_keys));
    }

    loop {
        let key: String = cliclack::input("Environment variable name:")
            .placeholder("API_KEY")
            .interact()?;

        let value: String = cliclack::password("Environment variable value:")
            .mask('▪')
            .interact()?;

        if !try_store_secret(config, &key, value)? {
            return Err(anyhow::anyhow!("Failed to store secret"));
        }
        env_keys.push(key);

        if !cliclack::confirm("Add another environment variable?").interact()? {
            break;
        }
    }

    Ok((envs, env_keys))
}

fn collect_headers() -> anyhow::Result<HashMap<String, String>> {
    let mut headers = HashMap::new();

    if !cliclack::confirm("Would you like to add custom headers?").interact()? {
        return Ok(headers);
    }

View on GitHub (pinned to 3810898a74)

Solutions

1. Install and unlock a secret service (e.g. gnome-keyring) and ensure DBUS_SESSION_BUS_ADDRESS is set for your session
2. Run configure from a desktop session where the keyring is already unlocked
3. Skip storing inside goose: export the variable in your shell profile or .env instead
4. Retry after granting keychain access to the terminal app

# Linux: verify a secret service is reachable before the wizard
pgrep -x gnome-keyring-daemon >/dev/null 2>&1 \
  || echo 'warning: no secret service detected; env-var storage may fail'

When it happens

Trigger: Adding an env var in the configure wizard on a system where the credential store is unavailable: Linux without a running secret service (gnome-keyring/kwallet over dbus), a locked keyring, or an OS keychain access prompt denied.

Common situations: Containers, minimal window managers, and SSH sessions with no dbus secret service; locked GNOME keyring at first login; CI runners with no keyring; macOS keychain permission denied for the terminal.

Related errors

• GOOSE_SERVER__SECRET_KEY must be set when using GOOSE_EXTERN
• No goose binary available for ${key}. Set GOOSE_BINARY to th
• Missing env vars for provider '{provider}': {', '.join(missi
• OPENAI_API_KEY environment variable is not set, but is neede
• TLS was requested but no TLS backend is enabled. Enable the

AI-assisted analysis of aaif-goose/goose@3810898a74 (2026-08-16). Data as JSON: /api/errors/bbd99d3ced74533f. Report an issue: GitHub.