{"record":{"id":"36ab2b3727a8e9eb","repo":"docker/cli","slug":"failed-to-erase-tokens-w","errorCode":null,"errorMessage":"failed to erase tokens: %w","messagePattern":"failed to erase tokens: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/oauth/manager/manager.go","lineNumber":181,"sourceCode":"// returned.\nfunc (m *OAuthManager) Logout(ctx context.Context) error {\n\trefreshConfig, err := m.store.Get(refreshTokenKey)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif refreshConfig.Password == \"\" {\n\t\treturn nil\n\t}\n\tparts := strings.Split(refreshConfig.Password, \"..\")\n\tif len(parts) != 2 {\n\t\t// the token wasn't stored by the CLI, so don't revoke it\n\t\t// or erase it from the store/error\n\t\treturn nil\n\t}\n\t// erase the token from the store first, that way\n\t// if the revoke fails, the user can try to logout again\n\tif err := m.eraseTokensFromStore(); err != nil {\n\t\treturn fmt.Errorf(\"failed to erase tokens: %w\", err)\n\t}\n\tif err := m.api.RevokeToken(ctx, parts[0]); err != nil {\n\t\treturn fmt.Errorf(\"credentials erased successfully, but there was a failure to revoke the OAuth refresh token with the tenant: %w\", err)\n\t}\n\treturn nil\n}\n\nconst (\n\taccessTokenKey  = registry.IndexServer + \"access-token\"\n\trefreshTokenKey = registry.IndexServer + \"refresh-token\"\n)\n\nfunc (m *OAuthManager) storeTokensInStore(tokens api.TokenResponse, username string) error {\n\treturn errors.Join(\n\t\tm.store.Store(types.AuthConfig{\n\t\t\tUsername:      username,\n\t\t\tPassword:      tokens.AccessToken,\n\t\t\tServerAddress: accessTokenKey,","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/oauth/manager/manager.go#L163-L199","documentation":"Returned by OAuthManager.Logout when eraseTokensFromStore() fails. During logout the manager first erases the stored access/refresh tokens; if the credential store rejects the erase (Erase/Save), logout aborts with the wrapped error before attempting revoke.","triggerScenarios":"The credential helper Erase call or config.json rewrite fails: locked keyring, helper binary missing, permission denied on ~/.docker/config.json.","commonSituations":"Keyring locked at logout time; helper removed since login; file permissions changed; disk full / read-only.","solutions":["Unlock/repair the credential store (unlock keychain, reinstall helper).","Ensure ~/.docker/config.json is writable.","Re-run `docker logout`.","As a last resort, manually remove the entries from config.json / keyring."],"exampleFix":"# before: logout fails erasing\ndocker logout  # -> failed to erase tokens\nunlock-keychain\nsudo apt-get install docker-credential-pass\ndocker logout","handlingStrategy":"try-catch","validationCode":"// verify the store can erase before relying on logout\nif err := store.Erase(refreshTokenKey); err != nil { /* fix store first */ }","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"failed to erase tokens\") { repairStore(); retry logout }","preventionTips":["Keep the credential helper installed between login and logout.","Unlock keyrings before logout.","Ensure config.json stays writable."],"tags":["oauth","credential-store","logout","auth","docker-hub"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}