{"record":{"id":"f57bc5a943643c20","repo":"googleworkspace/cli","slug":"failed-to-set-key-in-os-keyring","errorCode":null,"errorMessage":"Failed to set key in OS keyring: {}","messagePattern":"Failed to set key in OS keyring: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/google-workspace-cli/src/credential_store.rs","lineNumber":241,"sourceCode":"                            }\n                            return Ok(arr);\n                        }\n                    }\n                    // Keyring contained invalid data — fall through to generate new.\n                }\n                Err(keyring::Error::NoEntry) => {\n                    // Keyring is empty — fall through to generate new.\n                }\n                Err(e) => {\n                    anyhow::bail!(\"OS keyring failed: {}. Set GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file to use file storage.\", sanitize_for_terminal(&e.to_string()));\n                }\n            }\n\n            // Generate a new key if keyring was empty or contained invalid data.\n            let key = generate_random_key();\n            let b64_key = STANDARD.encode(key);\n            if let Err(e) = provider.set_password(&b64_key) {\n                anyhow::bail!(\n                    \"Failed to set key in OS keyring: {}\",\n                    sanitize_for_terminal(&e.to_string())\n                );\n            }\n            if let Err(e) = std::fs::remove_file(key_file) {\n                if e.kind() != std::io::ErrorKind::NotFound {\n                    eprintln!(\n                        \"Warning: failed to remove legacy key file at '{}': {}\",\n                        key_file.display(),\n                        e\n                    );\n                }\n            }\n            return Ok(key);\n        }\n\n        #[cfg(not(any(target_os = \"macos\", target_os = \"windows\")))]\n        {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/googleworkspace/cli/blob/a3768d0e82ad83cca2da97724e46bea4ff0e6dbd/crates/google-workspace-cli/src/credential_store.rs#L223-L259","documentation":"After the keyring was empty (or held invalid data), get_or_create_key generates a fresh 32-byte AES key and persists it with provider.set_password(). This error fires when that write fails — the read path worked (or was empty) but the keyring rejects writes: locked keychain, read-only secret service, dbus policy denying writes, or keyring quota issues.","triggerScenarios":"First run on a machine where the keyring allows lookup but not storage (macOS keychain locked, Linux secret service read-only or dbus policy restricted); keyring service crashing mid-write; running as a user without a keyring session.","commonSituations":"Initial `gws auth login` inside an SSH session on macOS; containers with a half-configured secret service; SELinux/AppArmor denying keyring writes; CI runners that emulate a keyring partially.","solutions":["Set GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file so the key is stored on disk instead","Unlock the keychain (macOS: security unlock-keychain) or restart the secret service (Linux) and retry","Check dbus policy/SELinux denials for the secret service write path"],"exampleFix":"# before\n$ gws auth login\nError: Failed to set key in OS keyring: ...\n\n# after\n$ GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file gws auth login","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the file backend in non-interactive environments from the start (GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file)","Unlock keychains (security unlock-keychain on macOS) before scripted logins","Avoid mixing first-ever logins across concurrent sessions on the same account"],"tags":["keyring","credentials","config","first-run"],"backgroundTag":"os-keyring-unavailable","analyzedSha":"a3768d0e82ad83cca2da97724e46bea4ff0e6dbd","analyzedAt":"2026-08-16T19:51:46.516Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}