tkmind/tkmind_go
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

docs: keyring fallback to secrets.yaml (#7165)

Browse Source
This commit is contained in:
dianed-square
2026-02-11 14:29:28 -08:00
committed by GitHub
parent cfa2778b4d
commit c6e27b8f84
4 changed files with 79 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/docs/guides/config-files.md
+9 -3
View File
@@ -17,7 +17,7 @@ The configuration files allow you to set default behaviors, configure language m
- **config.yaml** - Provider, model, extensions, and general settings
- **permission.yaml** - Tool permission levels configured via `goose configure`
- **secrets.yaml** - API keys and secrets (only when keyring is disabled)
- **secrets.yaml** - API keys and secrets (when goose is using [file-based secret storage](#security-considerations))
- **permissions/tool_permissions.json** - Runtime permission decisions (auto-managed)
- **prompts/** - Customized [prompt templates](/docs/guides/prompt-templates)
@@ -177,8 +177,14 @@ Settings are applied in the following order of precedence:
## Security Considerations
- Avoid storing sensitive information (API keys, tokens) in the config file
- Use the system keyring for storing secrets
- If keyring is disabled, secrets are stored in a separate `secrets.yaml` file
- Use the system keyring (keychain on macOS) for storing secrets. When available, this is the recommended option.
- If goose is using file-based secret storage, secrets are stored in a separate `secrets.yaml` file (in plain text). This can happen when:
- Your environment does not provide a desktop keyring service (for example: headless servers, CI/CD, containers)
- You disable the keyring explicitly (via [GOOSE_DISABLE_KEYRING](/docs/guides/environment-variables#security-and-privacy))
- goose cannot access the keyring and falls back to file-based secret storage
For troubleshooting keyring failures and automatic fallback behavior, see [Known Issues](/docs/troubleshooting/known-issues#keyring-cannot-be-accessed-automatic-fallback).
## Updating Configuration
documentation/docs/guides/environment-variables.md
+1 -1
View File
@@ -402,7 +402,7 @@ export GOOSE_TELEMETRY_ENABLED=true # Enable telemetry
```
:::tip
When the keyring is disabled, secrets are stored here:
When the keyring is disabled (or cannot be accessed and goose [falls back to file-based storage](/docs/troubleshooting/known-issues#keyring-cannot-be-accessed-automatic-fallback)), secrets are stored here:
* macOS/Linux: `~/.config/goose/secrets.yaml`
* Windows: `%APPDATA%\Block\goose\config\secrets.yaml`