google-gemini/gemini-cli · warning · Error

Failed to clear OAuth credentials

Error message

Failed to clear OAuth credentials

What it means

Thrown by OAuthCredentialStorage.clearCredentials() when the underlying HybridTokenStorage fails to delete the stored credentials. The method attempts to delete from keychain storage and also removes the legacy file at ~/.gemini/oauth_creds.json (best-effort, errors ignored). If the primary storage.deleteCredentials() call throws, the error is wrapped with cause and re-thrown, blocking the logout/clear operation.

Source

Thrown at packages/core/src/code_assist/oauth-credential-storage.ts:105

  }

  /**
   * Clear cached OAuth credentials
   */
  static async clearCredentials(): Promise<void> {
    try {
      await this.storage.deleteCredentials(MAIN_ACCOUNT_KEY);

      // Also try to remove the old file if it exists
      const oldFilePath = path.join(homedir(), GEMINI_DIR, OAUTH_FILE);
      await fs.rm(oldFilePath, { force: true }).catch(() => {});
    } catch (error: unknown) {
      coreEvents.emitFeedback(
        'error',
        'Failed to clear OAuth credentials',
        error,
      );
      throw new Error('Failed to clear OAuth credentials', { cause: error });
    }
  }

  /**
   * Migrate credentials from old file-based storage to keychain
   */
  private static async migrateFromFileStorage(): Promise<Credentials | null> {
    const oldFilePath = path.join(homedir(), GEMINI_DIR, OAUTH_FILE);

    let credsJson: string;
    try {
      credsJson = await fs.readFile(oldFilePath, 'utf-8');
    } catch (error: unknown) {
      if (
        typeof error === 'object' &&
        error !== null &&
        'code' in error &&
        error.code === 'ENOENT'

View on GitHub (pinned to 5024443c72)

Solutions

1. On macOS, unlock the login keychain before clearing.
2. On Linux, ensure gnome-keyring/seahorse is running and accessible.
3. Manually remove the credentials: delete the ~/.gemini/oauth_creds.json file and the keychain entry for 'gemini-cli-oauth / main-account'.
4. In environments where keychain is unavailable, set up a file-based token storage backend or use API key auth instead.
5. Inspect error.cause for the specific backend error.

try {
  await OAuthCredentialStorage.clearCredentials();
} catch (e) {
  if (e instanceof Error && e.message === 'Failed to clear OAuth credentials') {
    // Best-effort: manually remove the legacy file
    await fs.rm(path.join(homedir(), '.gemini', OAUTH_FILE), { force: true }).catch(() => {});
    console.warn('Could not clear keychain entry. Remove it manually from your OS keychain.');
  } else throw e;
}

When it happens

Trigger: Calling OAuthCredentialStorage.clearCredentials() when storage.deleteCredentials('main-account') throws — typically a keychain access error, a locked keychain, or a missing secret-service daemon.

Common situations: User attempts to log out but the OS keychain is locked (macOS) or secret-service is unavailable (Linux headless/CI); permission changes revoked the application's keychain access; the keychain backend changed between sessions (e.g., switching desktop environments); running in a sandboxed environment that blocks keychain writes.

Related errors

• Failed to load OAuth credentials
• Attempted to save credentials without an access token.
• ${originalMessage}. The initial COMPUTE_ADC attempt also fai
• Could not authenticate using metadata server application def
• Manual authorization is required but the current session is

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/e45b62d12414aa29. Report an issue: GitHub.