keyring

Documentation

Index

• Constants
• func ActiveClaudeEmail() string
• func BackfillCredentialsFile(acct *ClaudeOAuth)
• func Hash8(s string) string
• func PersistRefreshedToken(acct *ClaudeOAuth)
• func RemoveActiveClaudeCredentialsByEmail(email string) error
• func RemoveCQClaudeAccountsByEmail(email string) error
• func RemovePlatformClaudeKeychainAccountsByEmail(email string) error
• func StoreCQAccount(acct *ClaudeOAuth) error
• func UpdateKeychainEntry(service string, creds *ClaudeCredentials) error
• func WriteCredentialsFile(creds *ClaudeCredentials) error
• type ClaudeCredentials
• type ClaudeOAuth
  • func DiscoverClaudeAccounts() []ClaudeOAuth
• type TokenAccount

Constants

const ServicePrefix = "cq-claude-"

ServicePrefix is the keyring service prefix for cq-managed accounts.

Functions

func ActiveClaudeEmail

func ActiveClaudeEmail() string

ActiveClaudeEmail returns the email of the currently active Claude account from ~/.claude/.credentials.json. Returns "" if unavailable.

func BackfillCredentialsFile

func BackfillCredentialsFile(acct *ClaudeOAuth)

BackfillCredentialsFile updates the active credentials file with profile data (email, UUID, plan, tier) without overwriting the tokens.

func Hash8

func Hash8(s string) string

Hash8 returns first 8 hex chars of SHA-256 for use in service names.

func PersistRefreshedToken

func PersistRefreshedToken(acct *ClaudeOAuth)

PersistRefreshedToken updates stored Claude credentials after a successful refresh.

func RemoveActiveClaudeCredentialsByEmail

func RemoveActiveClaudeCredentialsByEmail(email string) error

RemoveActiveClaudeCredentialsByEmail clears the active Claude credentials when they belong to the given email.

func RemoveCQClaudeAccountsByEmail

func RemoveCQClaudeAccountsByEmail(email string) error

RemoveCQClaudeAccountsByEmail deletes cq-managed Claude account state for all manifest rows matching the given email.

func RemovePlatformClaudeKeychainAccountsByEmail

func RemovePlatformClaudeKeychainAccountsByEmail(email string) error

RemovePlatformClaudeKeychainAccountsByEmail is a no-op on non-macOS platforms.

func StoreCQAccount

func StoreCQAccount(acct *ClaudeOAuth) error

StoreCQAccount stores credentials in the cross-platform keyring and updates the manifest.

func UpdateKeychainEntry

func UpdateKeychainEntry(service string, creds *ClaudeCredentials) error

UpdateKeychainEntry is a no-op on non-macOS platforms. Use StoreCQAccount for cross-platform keyring storage.

func WriteCredentialsFile

func WriteCredentialsFile(creds *ClaudeCredentials) error

WriteCredentialsFile atomically writes credentials to ~/.claude/.credentials.json.

Types

type ClaudeCredentials

type ClaudeCredentials struct {
	ClaudeAiOauth *ClaudeOAuth `json:"claudeAiOauth,omitempty"`
}

ClaudeCredentials is the format stored in Claude Code's keychain entry.

type ClaudeOAuth

type ClaudeOAuth struct {
	AccessToken      string          `json:"accessToken"`
	RefreshToken     string          `json:"refreshToken"`
	ExpiresAt        int64           `json:"expiresAt"`
	Scopes           []string        `json:"scopes,omitempty"`
	SubscriptionType string          `json:"subscriptionType,omitempty"`
	RateLimitTier    string          `json:"rateLimitTier,omitempty"`
	Email            string          `json:"email,omitempty"`
	AccountUUID      string          `json:"accountUUID,omitempty"`
	Profile          json.RawMessage `json:"profile,omitempty"`
	TokenAccount     *TokenAccount   `json:"tokenAccount,omitempty"`
}

func DiscoverClaudeAccounts

func DiscoverClaudeAccounts() []ClaudeOAuth

DiscoverClaudeAccounts finds all Claude accounts from: 1. ~/.claude/.credentials.json (active account) 2. Platform keychain (macOS: "Claude Code-credentials*", all: cq-claude-* via go-keyring)

type TokenAccount

type TokenAccount struct {
	UUID             string `json:"uuid"`
	EmailAddress     string `json:"emailAddress"`
	OrganizationUUID string `json:"organizationUuid"`
}