pub async fn keychain_get(
service: &str,
account: &str,
) -> Result<Option<SecretString>, SecretError>Expand description
Read a secret from the OS keychain.
Returns Ok(None) when the entry doesn’t exist (so callers can fall
through to the next precedence layer cleanly), and Err(...) only for
real backend failures (locked keychain, permission denied, malformed
service/account, transport error). Silently swallowing those errors would
mask configuration problems and let the next fallback layer take over
when the user actually expected the keychain entry to be honored.
Pairs with keychain_set / keychain_delete.