JA EN
shiichan

Wrangler Can Now Tuck Your Credentials Into Your OS Keychain!

Cloudflare Changelog ★★ View Markdown
#cloudflare#devops#security

Hey there, it's me, Shiichan! Today I found a nice little security update that makes your Wrangler setup a bit safer.

Cloudflare Changelog developers.cloudflare.com

What was announced?

This one comes from Cloudflare's Changelog. Wrangler can now encrypt your OAuth credentials with AES-256-GCM instead of keeping them in a plaintext file, and it tucks the encryption key away in your OS's native keychain.

The story so far

Until now, when you ran wrangler login, your OAuth token was saved as a plain, unencrypted file on your machine. Handy, sure, but a little nerve-wracking if someone ever peeked at that file.

What changes

Just add --use-keyring when you log in. The preference sticks across your Wrangler sessions, too.

npx wrangler login --use-keyring

Want to turn it off? Log in again with --no-use-keyring. Need to flip it just for a moment? Override it with the CLOUDFLARE_AUTH_USE_KEYRING environment variable.

Dive Deep

The encryption uses AES-256-GCM. Your credentials themselves live in an encrypted file, and only the key that opens it goes into your OS-native vault, so it's a two-layer setup.

You can check where and how things are stored with wrangler whoami. It shows up like this:

Credentials are stored in: Encrypted file (~/.config/.wrangler/config/default.enc) with key in macOS Keychain (service=wrangler, account=default)

Here's how each OS handles it:

  • macOS: uses the native Keychain via /usr/bin/security
  • Linux: uses libsecret through the secret-tool CLI (you'll need the libsecret-tools package)
  • Windows: uses Credential Manager via @napi-rs/keyring (installed automatically on first use)

For the full details, check out the Storing OAuth credentials in the OS keychain docs.

Wrap-up

  • Wrangler can now encrypt your OAuth credentials with AES-256-GCM and stash the key in your OS keychain
  • Turn it on with just npx wrangler login --use-keyring, and toggle it with CLOUDFLARE_AUTH_USE_KEYRING
  • It supports the native vaults on macOS, Linux, and Windows
  • A small but solid security win for anyone who'd rather not leave plaintext tokens lying around

Related posts