Module secrets 

Credential storage.

Tokens live in the OS keychain (macOS Keychain, Windows Credential Manager, Secret Service on Linux) and are keyed by account, not by profile, so one login serves every organisation that account can see.

There is deliberately no plaintext fallback and no command that prints a token to stdout: a missing keychain is an error with instructions, not a silent downgrade to a file anyone can read.

Enums

Origin

Where a token came from.

SecretError

Functions

forget

Remove the stored token, and what renews it. Removing a token that is not there is not an error.

is_stored

Whether a token exists, without moving the secret itself around.

overridden

Whether the environment is standing in for the keychain.

refresh_token

The refresh token for an account — there is one only when its token came from signing in, not from pasting.

store

Store (or replace) the OAuth token for an account.

store_refresh

Store the refresh token that came with a token, or remove the one that no longer belongs to it.

token

Fetch the OAuth token for an account.

token_from

Fetch it, and say where it came from.