googleworkspace/cli · error

Failed to set key in OS keyring: {}

Error message

Failed to set key in OS keyring: {}

What it means

After the keyring was empty (or held invalid data), get_or_create_key generates a fresh 32-byte AES key and persists it with provider.set_password(). This error fires when that write fails — the read path worked (or was empty) but the keyring rejects writes: locked keychain, read-only secret service, dbus policy denying writes, or keyring quota issues.

Source

Thrown at crates/google-workspace-cli/src/credential_store.rs:241

                            }
                            return Ok(arr);
                        }
                    }
                    // Keyring contained invalid data — fall through to generate new.
                }
                Err(keyring::Error::NoEntry) => {
                    // Keyring is empty — fall through to generate new.
                }
                Err(e) => {
                    anyhow::bail!("OS keyring failed: {}. Set GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file to use file storage.", sanitize_for_terminal(&e.to_string()));
                }
            }

            // Generate a new key if keyring was empty or contained invalid data.
            let key = generate_random_key();
            let b64_key = STANDARD.encode(key);
            if let Err(e) = provider.set_password(&b64_key) {
                anyhow::bail!(
                    "Failed to set key in OS keyring: {}",
                    sanitize_for_terminal(&e.to_string())
                );
            }
            if let Err(e) = std::fs::remove_file(key_file) {
                if e.kind() != std::io::ErrorKind::NotFound {
                    eprintln!(
                        "Warning: failed to remove legacy key file at '{}': {}",
                        key_file.display(),
                        e
                    );
                }
            }
            return Ok(key);
        }

        #[cfg(not(any(target_os = "macos", target_os = "windows")))]
        {

View on GitHub (pinned to a3768d0e82)

Solutions

1. Set GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file so the key is stored on disk instead
2. Unlock the keychain (macOS: security unlock-keychain) or restart the secret service (Linux) and retry
3. Check dbus policy/SELinux denials for the secret service write path

Example fix

# before
$ gws auth login
Error: Failed to set key in OS keyring: ...

# after
$ GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file gws auth login

When it happens

Trigger: First run on a machine where the keyring allows lookup but not storage (macOS keychain locked, Linux secret service read-only or dbus policy restricted); keyring service crashing mid-write; running as a user without a keyring session.

Common situations: Initial `gws auth login` inside an SSH session on macOS; containers with a half-configured secret service; SELinux/AppArmor denying keyring writes; CI runners that emulate a keyring partially.

Related errors

• OS keyring failed: {}. Set GOOGLE_WORKSPACE_CLI_KEYRING_BACK
• GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE points to {path}, but
• Decryption failed. Credentials may have been created on a di
• GOOGLE_APPLICATION_CREDENTIALS points to {adc_env}, but file
• No credentials found. Run `gws auth setup` to configure, `gw

AI-assisted analysis of googleworkspace/cli@a3768d0e82 (2026-08-16). Data as JSON: /api/errors/f57bc5a943643c20. Report an issue: GitHub.