One small secret-store API — Set, Get, Delete — backed by the host platform's own credential vault.
A program that needs to keep a token should not have to know which vault the machine happens to run. This is the façade over the three that matter, with the same three calls on each: the macOS Keychain, the Windows Credential Manager and the freedesktop Secret Service.
No cgo and no exec. Both matter for the same reason: a secret handed to a subprocess is visible in that process's argv, and a cgo dependency is the thing that stops a Go binary cross-compiling.
keyring
façadenative vault per platform, no cgo
keyring.Set(service, account, secret) and its Get / Delete pair, over the host's native credential store.
Cross-platform by delegation, not by lowest common denominator: each back-end speaks its own vault's API directly.
The platform back-ends are the fleet's own CGO-free bindings rather than re-implementations: go-macos/keychain on darwin and go-mswin/win32 on Windows, so the vault access and the rest of the OS surface are built the same way.