---
title: Store Wrangler's OAuth credentials in your OS keychain
description: Opt in to encrypt Wrangler's OAuth tokens at rest using a key held in macOS Keychain, libsecret, or Windows Credential Manager.
image: https://edgetunnel-b2h.pages.dev/changelog-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

[ ← Back to all posts ](https://edgetunnel-b2h.pages.dev/changelog/) 

## Store Wrangler's OAuth credentials in your OS keychain

Jun 03, 2026 

[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) 

[Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/) can now store the OAuth credentials returned by `wrangler login` in an [AES-256-GCM ↗](https://en.wikipedia.org/wiki/Galois/Counter%5FMode)\-encrypted file, with the encryption key held in your operating system keychain. The default behavior is unchanged — credentials still live in a plaintext TOML file unless you opt in.

To opt in, run:

```sh
npx wrangler login --use-keyring
```

The choice is persisted across Wrangler invocations. Opt back out with `npx wrangler login --no-use-keyring`, or override the preference for a single command with the `CLOUDFLARE_AUTH_USE_KEYRING` environment variable.

`wrangler whoami` now reports where credentials are stored:

```sh
🔐 Credentials are stored in: Encrypted file (~/.config/.wrangler/config/default.enc) with key in macOS Keychain (service=wrangler, account=default)
```

Per-platform backends:

* **macOS** uses the built-in Keychain via `/usr/bin/security`.
* **Linux** uses [libsecret ↗](https://wiki.gnome.org/Projects/Libsecret) via the `secret-tool` CLI from the `libsecret-tools` package.
* **Windows** uses Credential Manager via [@napi-rs/keyring ↗](https://www.npmjs.com/package/@napi-rs/keyring), installed on-demand the first time you opt in.

Refer to [Storing OAuth credentials in the OS keychain](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#storing-oauth-credentials-in-the-os-keychain) for the full details, including the migration behavior on opt-in/opt-out and the `CLOUDFLARE_AUTH_USE_KEYRING` environment variable.

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-03-wrangler-keyring-credential-storage/#page","headline":"Store Wrangler's OAuth credentials in your OS keychain · Changelog","description":"Opt in to encrypt Wrangler's OAuth tokens at rest using a key held in macOS Keychain, libsecret, or Windows Credential Manager.","url":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-03-wrangler-keyring-credential-storage/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/changelog-preview.png","dateModified":"2026-06-03","datePublished":"2026-06-03","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```