go-keyring logo go-keyring
LICENSE=BSD-3-ClauseCGO_ENABLED=0
Fork me on GitHub

go-keyring

One small secret-store API — Set, Get, Delete — backed by the host platform's own credential vault.

GitHub Go reference
CGO_ENABLED=0no CLI execmacOS · Windows · freedesktopBSD-3-Clause
zsh
$ go get github.com/go-keyring/keyring@latest
One organisation, 1 repositories
keyring

A program that needs to keep a token should not have to know which vault the machine happens to run. This is the façade over the three that matter, with the same three calls on each: the macOS Keychain, the Windows Credential Manager and the freedesktop Secret Service.

No cgo and no exec. Both matter for the same reason: a secret handed to a subprocess is visible in that process's argv, and a cgo dependency is the thing that stops a Go binary cross-compiling.

Repositories

keyring façade

native vault per platform, no cgo

keyring.Set(service, account, secret) and its Get / Delete pair, over the host's native credential store.

Cross-platform by delegation, not by lowest common denominator: each back-end speaks its own vault's API directly.

CI Go reference

The platform back-ends are the fleet's own CGO-free bindings rather than re-implementations: go-macos/keychain on darwin and go-mswin/win32 on Windows, so the vault access and the rest of the OS surface are built the same way.