feat(oauth): Use keyring to store oauth token by burmudar · Pull Request #1228 · sourcegraph/src-cli

burmudar · 2025-12-08T10:42:01Z

This adds a keyring which is used to store OAuth credentials. The OAuth credentials are retrieved from the keyring whenever there is no SRC_ACCESS_TOKEN defined.

When we use an OAuth token, we also add a OAuth transport which will automatically refresh the access token using the refresh token when it is near to expiring.

Credentials are stored in the keyring with under the service "Sourcegraph CLI" and with key "src:oauth:". The reason for the endpoint being in the key name is that some clients might access multiple sourcegraph instances like dev and prod, and we can't reuse the same credentials for the different servers.

Test plan

Authorize by running src login --oauth https://sourcegraph.sourcegraph.com
run export SRC_ENDPOINT=https://sourcegraph.sourcegraph.com; echo 'query { currentUser { username } }' | go run ./cmd/src api
Revoke access of Sourcegraph CLI application and rerun previous command

The OAuth token is invalid. Please check that the Sourcegraph CLI client is still authorized.

To re-authorize, run: src login

Learn more at https://github.com/sourcegraph/src-cli#readme

error: 401 Unauthorized

Invalid OAuth token.
exit status 1

Platforms tested

Mac
Windows
Linux

burmudar · 2025-12-08T10:42:03Z

This change is part of the following stack:

feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223
- feat(oauth): Add refresh to oauthdevice.Client #1227
  - feat(oauth): Use keyring to store oauth token #1228 ◀

_{Change managed by git-spice.}

cmd/src/login.go

internal/oauth/http_transport.go

internal/secrets/keyring.go

keegancsmith · 2026-03-02T08:23:10Z

internal/secrets/keyring.go

+}
+
+// Put stores a key-value pair in the keyring.
+func (k *keyringStore) Put(key string, data []byte) error {


given the underlying library is all just global function calls, why don't we just do the same and wrap them with the service name we use?

My main motivation to keep a struct is to avoid making Get / Put param lists be "a lot" e.g.
Put(ctx context.Context, endpoint, key string, data []byte)
Get(ctx context.Context, endpoint, key string)

We also centralize the store name to only happen once Open is called. Once it is open, the user doesn't have to keep extra context about the endpoint and can just use the store.

keegancsmith

My main concern is hitting libsecret/etc when we don't need to. But the underlying library looks good + we only open the keyring when doing oauth. So LGTM

internal/secrets/keyring.go

- rename keyring to store - make keyring struct src-cli and set label on secret

- create token struct from TokenResponse - Token converts expiresIn to a timestamp - Store the token with the endpoint suffix - OAuth transport and use when available in api client

- Add secret store that supports different backends - We use a registry map for a few secrets and the registry gets persisted as one secret to the keyring. We don't waant to create a keyring secret for every different secret - Store is opened once to load the registry. - use secretStorage to store oauth tokens

Amp-Thread-ID: https://ampcode.com/threads/T-019bea47-5179-7418-86cf-bf1d4cc93d28 Co-authored-by: Amp <amp@ampcode.com> - minor keyring refactor

- use token.ClientID during refresh - best effort store refresh token

handle oauth discovery failure and set client id on token - use SRC CLI client id as default and handle discovery failures - add clientID flag and set it on the token improve error message and panic in apiClient if no usable token - warn if we fail to store the token on login - panic if apiClient has no accessToken or OAuth token to use

- remove panic - use lib/errors from sg

- remove delete operation - remove store interface

- add mutex to guard concurrent changes of token - pull refreshing of token out into `refreshToken` - additional comments

* add refresh to oauthdevice.Client * oauthdevice: add RefreshToken field and Refresh method * feat(oauth): Use keyring to store oauth token (#1228) * add refresh to oauthdevice.Client * add OAuth Transport and use it if no access token * secrets: switch to zalando/go-keyring and add context support * secrets: scope keyring by endpoint

…Auth client (#1223) * removed unused func * add refresh token to device response unmarshall * make NewClient take ClientID as param * add oauth flow and use oauth token when SRC_ACCESS_TOKEN is empty * feat(oauth): Add refresh to oauthdevice.Client (#1227) * add refresh to oauthdevice.Client * oauthdevice: add RefreshToken field and Refresh method * feat(oauth): Use keyring to store oauth token (#1228) * add refresh to oauthdevice.Client * add OAuth Transport and use it if no access token * secrets: switch to zalando/go-keyring and add context support * secrets: scope keyring by endpoint

…Auth client (#1223) * removed unused func * add refresh token to device response unmarshall * make NewClient take ClientID as param * add oauth flow and use oauth token when SRC_ACCESS_TOKEN is empty * feat(oauth): Add refresh to oauthdevice.Client (#1227) * add refresh to oauthdevice.Client * oauthdevice: add RefreshToken field and Refresh method * feat(oauth): Use keyring to store oauth token (#1228) * add refresh to oauthdevice.Client * add OAuth Transport and use it if no access token * secrets: switch to zalando/go-keyring and add context support * secrets: scope keyring by endpoint (cherry picked from commit 0bc535e)

This was referenced Dec 8, 2025

feat(oauth): Add refresh to oauthdevice.Client #1227

Merged

feat(oauth): use oauth device flow to authenticate with predefined src-cli OAuth client #1223

Merged

keegancsmith reviewed Dec 8, 2025

View reviewed changes

cmd/src/login.go Outdated Show resolved Hide resolved

burmudar force-pushed the wb/add-oauth-refresh-token branch from 2f24f44 to 7f2c665 Compare January 23, 2026 09:03

burmudar force-pushed the wb/oauth-keyring branch from 278fc77 to 6f58c79 Compare January 23, 2026 09:03

burmudar force-pushed the wb/add-oauth-refresh-token branch from 7f2c665 to 87b5732 Compare January 23, 2026 09:10

burmudar force-pushed the wb/oauth-keyring branch from 6f58c79 to 5a355f7 Compare January 23, 2026 09:10

burmudar force-pushed the wb/add-oauth-refresh-token branch from 87b5732 to abd0850 Compare February 26, 2026 12:33

burmudar force-pushed the wb/oauth-keyring branch from 5a355f7 to 0f2e720 Compare February 26, 2026 12:33

burmudar self-assigned this Feb 26, 2026

burmudar requested review from a team, eseliger and keegancsmith February 26, 2026 13:58

burmudar force-pushed the wb/oauth-keyring branch 2 times, most recently from 64897ef to 7978cce Compare February 26, 2026 14:05

burmudar marked this pull request as ready for review February 26, 2026 14:08

burmudar commented Feb 26, 2026

View reviewed changes

cmd/src/login.go Show resolved Hide resolved

keegancsmith reviewed Mar 2, 2026

View reviewed changes

internal/oauth/http_transport.go Outdated Show resolved Hide resolved

keegancsmith reviewed Mar 2, 2026

View reviewed changes

internal/secrets/keyring.go Outdated Show resolved Hide resolved

keegancsmith reviewed Mar 2, 2026

View reviewed changes

internal/secrets/keyring.go Outdated Show resolved Hide resolved

keegancsmith reviewed Mar 2, 2026

View reviewed changes

internal/secrets/keyring.go Outdated Show resolved Hide resolved

burmudar added 6 commits March 9, 2026 11:13

add refresh to oauthdevice.Client

df1be25

add internal/keyring package to use 99designs keyring

2b97963

- rename keyring to store - make keyring struct src-cli and set label on secret

add OAuth Transport and use it if no access token

eb6b023

- create token struct from TokenResponse - Token converts expiresIn to a timestamp - Store the token with the endpoint suffix - OAuth transport and use when available in api client

secrets: switch to zalando/go-keyring and add context support

ff3419d

Amp-Thread-ID: https://ampcode.com/threads/T-019bea47-5179-7418-86cf-bf1d4cc93d28 Co-authored-by: Amp <amp@ampcode.com> - minor keyring refactor

token refresh

4c191f2

- use token.ClientID during refresh - best effort store refresh token

burmudar added 9 commits March 9, 2026 11:13

fix removal of client id

2366148

fix package rename

6032dfd

report a nicer error when OAuth fails

9ea78c7

refactor token refresh tests

5919c10

fix ci

15f2cfd

- remove panic - use lib/errors from sg

inform user of oauth login

d28e709

fix spelling

dd28116

refactor: secrets

c549192

- remove delete operation - remove store interface

burmudar force-pushed the wb/oauth-keyring branch from ba0344d to e2d7bd2 Compare March 9, 2026 09:28

burmudar force-pushed the wb/add-oauth-refresh-token branch from abd0850 to f79c981 Compare March 9, 2026 09:30

burmudar added 2 commits March 9, 2026 11:39

secrets: scope keyring by endpoint

12fd801

refactor: oauth

e8795cb

- add mutex to guard concurrent changes of token - pull refreshing of token out into `refreshToken` - additional comments

burmudar force-pushed the wb/oauth-keyring branch from e2d7bd2 to e8795cb Compare March 9, 2026 09:39

burmudar merged commit 88d56e9 into wb/add-oauth-refresh-token Mar 9, 2026
10 checks passed

burmudar deleted the wb/oauth-keyring branch March 9, 2026 09:52

burmudar mentioned this pull request Mar 9, 2026

fix: oauth token race in http_transport #1269

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(oauth): Use keyring to store oauth token#1228

feat(oauth): Use keyring to store oauth token#1228
burmudar merged 17 commits intowb/add-oauth-refresh-tokenfrom
wb/oauth-keyring

burmudar commented Dec 8, 2025 •

edited

Loading

Uh oh!

burmudar commented Dec 8, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

keegancsmith Mar 2, 2026

Uh oh!

burmudar Mar 9, 2026

Uh oh!

keegancsmith left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

burmudar commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test plan

Platforms tested

Uh oh!

burmudar commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

keegancsmith Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

burmudar Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

keegancsmith left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

burmudar commented Dec 8, 2025 •

edited

Loading

burmudar commented Dec 8, 2025 •

edited

Loading