Credential storage
The CLI keeps the session (the Ory refresh, ID and access tokens) and the temporary STS credentials of each role. Thus creds and the API commands work without a new sign-in.
Only the session keeps the refresh token. The refresh token changes each time it is used. Thus all roles and all API calls renew through the session, one at a time.
OS keyring (default)
The CLI keeps credentials in the OS keyring, with the service name source-coop-cli:
- The key of each role's credentials is its role ARN, for example
_default. - The key of the session is
@session. - For environments other than production, both keys start with the proxy host, for example
data.staging.source.coop/_defaultanddata.staging.source.coop/@session.
| Platform | Backend |
|---|---|
| macOS | Keychain (security / Keychain Access) |
| Windows | Credential Manager |
| Linux | Secret Service API (GNOME Keyring, KDE Wallet) via D-Bus |
File fallback
If there is no OS keyring (for example on servers, in containers and in CI), the CLI uses JSON files in the OS cache folder. On Unix, the files have 0600 permissions. You do not need to configure this.
| Platform | Path |
|---|---|
| macOS | ~/Library/Caches/source-coop/credentials/<role>.json |
| Linux | ~/.cache/source-coop/credentials/<role>.json |
| Windows | %LocalAppData%\source-coop\credentials\<role>.json |
The session is in source-coop/session.json. Other environments use the same layout in source-coop/env/<host>/, or in source-coop/env/<host>/<port>/ if the port is not the default. For example: source-coop/env/data.staging.source.coop/session.json.