# Wrangler Can Now Tuck Your Credentials Into Your OS Keychain!

Hey there, it's me, Shiichan! Today I found a nice little security update that makes your Wrangler setup a bit safer.

## What was announced?

This one comes from Cloudflare's Changelog. Wrangler can now encrypt your OAuth credentials with AES-256-GCM instead of keeping them in a plaintext file, and it tucks the encryption key away in your OS's native keychain.

## The story so far

Until now, when you ran `wrangler login`, your OAuth token was saved as a plain, unencrypted file on your machine. Handy, sure, but a little nerve-wracking if someone ever peeked at that file.

## What changes

Just add `--use-keyring` when you log in. The preference sticks across your Wrangler sessions, too.

```sh
npx wrangler login --use-keyring
```

Want to turn it off? Log in again with `--no-use-keyring`. Need to flip it just for a moment? Override it with the `CLOUDFLARE_AUTH_USE_KEYRING` environment variable.

## Dive Deep

The encryption uses [AES-256-GCM](https://en.wikipedia.org/wiki/Galois/Counter_Mode). Your credentials themselves live in an encrypted file, and only the key that opens it goes into your OS-native vault, so it's a two-layer setup.

You can check where and how things are stored with `wrangler whoami`. It shows up like this:

```sh
Credentials are stored in: Encrypted file (~/.config/.wrangler/config/default.enc) with key in macOS Keychain (service=wrangler, account=default)
```

Here's how each OS handles it:

- macOS: uses the native Keychain via `/usr/bin/security`
- Linux: uses [libsecret](https://wiki.gnome.org/Projects/Libsecret) through the `secret-tool` CLI (you'll need the `libsecret-tools` package)
- Windows: uses Credential Manager via @napi-rs/keyring (installed automatically on first use)

For the full details, check out the [Storing OAuth credentials in the OS keychain](https://developers.cloudflare.com/workers/wrangler/commands/general/#storing-oauth-credentials-in-the-os-keychain) docs.

## Wrap-up

- Wrangler can now encrypt your OAuth credentials with AES-256-GCM and stash the key in your OS keychain
- Turn it on with just `npx wrangler login --use-keyring`, and toggle it with `CLOUDFLARE_AUTH_USE_KEYRING`
- It supports the native vaults on macOS, Linux, and Windows
- A small but solid security win for anyone who'd rather not leave plaintext tokens lying around