From 0b74e4093e980804ba9b1e526a027ca201af5348 Mon Sep 17 00:00:00 2001
From: mikhail-oai <mikhail@openai.com>
Date: Sun, 15 Feb 2026 18:47:58 -0500
Subject: [PATCH] Use keyring as default CLI auth store on macOS

---
 codex-rs/core/config.schema.json  |  2 +-
 codex-rs/core/src/auth/storage.rs | 16 ++++++++++++++--
 codex-rs/core/src/config/mod.rs   | 20 +++++++++++---------
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index 7a1c40a0a1..74c0a984b7 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -1283,7 +1283,7 @@
         }
       ],
       "default": null,
-      "description": "Preferred backend for storing CLI auth credentials. file (default): Use a file in the Codex home directory. keyring: Use an OS-specific keyring service. auto: Use the keyring if available, otherwise use a file."
+      "description": "Preferred backend for storing CLI auth credentials. file (default on non-macOS): Use a file in the Codex home directory. keyring (default on macOS): Use an OS-specific keyring service. auto: Use the keyring if available, otherwise use a file."
     },
     "compact_prompt": {
       "description": "Compact prompt used for history compaction.",
diff --git a/codex-rs/core/src/auth/storage.rs b/codex-rs/core/src/auth/storage.rs
index 81d17e4e1e..6792fb5c20 100644
--- a/codex-rs/core/src/auth/storage.rs
+++ b/codex-rs/core/src/auth/storage.rs
@@ -26,10 +26,9 @@ use codex_keyring_store::KeyringStore;
 use once_cell::sync::Lazy;
 
 /// Determine where Codex should store CLI auth credentials.
-#[derive(Debug, Default, Copy, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "lowercase")]
 pub enum AuthCredentialsStoreMode {
-    #[default]
     /// Persist credentials in CODEX_HOME/auth.json.
     File,
     /// Persist credentials in the keyring. Fail if unavailable.
@@ -40,6 +39,19 @@ pub enum AuthCredentialsStoreMode {
     Ephemeral,
 }
 
+impl Default for AuthCredentialsStoreMode {
+    fn default() -> Self {
+        #[cfg(target_os = "macos")]
+        {
+            Self::Keyring
+        }
+        #[cfg(not(target_os = "macos"))]
+        {
+            Self::File
+        }
+    }
+}
+
 /// Expected structure for $CODEX_HOME/auth.json.
 #[derive(Deserialize, Serialize, Clone, Debug, PartialEq)]
 pub struct AuthDotJson {
diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index 5d887a6a59..6169a81c0f 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -261,8 +261,8 @@ pub struct Config {
     pub cwd: PathBuf,
 
     /// Preferred store for CLI auth credentials.
-    /// file (default): Use a file in the Codex home directory.
-    /// keyring: Use an OS-specific keyring service.
+    /// file (default on non-macOS): Use a file in the Codex home directory.
+    /// keyring (default on macOS): Use an OS-specific keyring service.
     /// auto: Use the OS-specific keyring service if available, otherwise use a file.
     pub cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
 
@@ -923,8 +923,8 @@ pub struct ConfigToml {
     pub forced_login_method: Option<ForcedLoginMethod>,
 
     /// Preferred backend for storing CLI auth credentials.
-    /// file (default): Use a file in the Codex home directory.
-    /// keyring: Use an OS-specific keyring service.
+    /// file (default on non-macOS): Use a file in the Codex home directory.
+    /// keyring (default on macOS): Use an OS-specific keyring service.
     /// auto: Use the keyring if available, otherwise use a file.
     #[serde(default)]
     pub cli_auth_credentials_store: Option<AuthCredentialsStoreMode>,
@@ -2465,9 +2465,14 @@ trust_level = "trusted"
     }
 
     #[test]
-    fn config_defaults_to_file_cli_auth_store_mode() -> std::io::Result<()> {
+    fn config_defaults_to_platform_cli_auth_store_mode() -> std::io::Result<()> {
         let codex_home = TempDir::new()?;
         let cfg = ConfigToml::default();
+        let expected_store_mode = if cfg!(target_os = "macos") {
+            AuthCredentialsStoreMode::Keyring
+        } else {
+            AuthCredentialsStoreMode::File
+        };
 
         let config = Config::load_from_base_config_with_overrides(
             cfg,
@@ -2475,10 +2480,7 @@ trust_level = "trusted"
             codex_home.path().to_path_buf(),
         )?;
 
-        assert_eq!(
-            config.cli_auth_credentials_store_mode,
-            AuthCredentialsStoreMode::File,
-        );
+        assert_eq!(config.cli_auth_credentials_store_mode, expected_store_mode,);
 
         Ok(())
     }