feat(auth): use os keyring for secure credential storage

package.json

@@ -76,6 +76,7 @@
 		"@inquirer/input": "^5.0.10",
 		"@inquirer/password": "^5.0.10",
 		"@inquirer/select": "^5.1.2",
+		"@napi-rs/keyring": "^1.3.0",
 		"@root/walk": "~1.1.0",
 		"@sapphire/duration": "^1.2.0",
 		"@sapphire/result": "^2.8.0",

src/commands/actors/search.ts

@@ -96,7 +96,7 @@ export class ActorsSearchCommand extends ApifyCommand<typeof ActorsSearchCommand
 		const { query } = this.args;
 		const { json, sortBy, category, username, pricingModel, limit, offset } = this.flags;
 
-		const clientOptions = getApifyClientOptions();
+		const clientOptions = await getApifyClientOptions();
 		delete clientOptions.token;
 		const client = new ApifyClient(clientOptions);
 

src/commands/auth/login.ts

@@ -1,5 +1,6 @@
 import type { Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
+import process from 'node:process';
 
 import chalk from 'chalk';
 import computerName from 'computer-name';
@@ -12,6 +13,7 @@ import { cryptoRandomObjectId } from '@apify/utilities';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { AUTH_FILE_PATH } from '../../lib/consts.js';
+import { getBackend } from '../../lib/credentials.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
 import { useMaskedInput } from '../../lib/hooks/user-confirmations/useMaskedInput.js';
 import { useSelectFromList } from '../../lib/hooks/user-confirmations/useSelectFromList.js';
@@ -34,8 +36,21 @@ const tryToLogin = async (token: string) => {
 	if (isUserLogged) {
 		await updateUserId(userInfo.id!);
 
+		const backend = await getBackend();
+		let tokenLocation: string;
+		if (backend === 'keyring') {
+			tokenLocation = 'your OS keyring';
+		} else if (process.env.APIFY_DISABLE_KEYRING === '1') {
+			tokenLocation = `${AUTH_FILE_PATH()} (OS keyring disabled via APIFY_DISABLE_KEYRING)`;
+		} else if (process.env.APIFY_CLI_BUNDLE) {
+			// Bundle distributions ship without the OS keyring native module — see
+			// https://github.com/apify/apify-cli/issues for the tracking issue.
+			tokenLocation = `${AUTH_FILE_PATH()} (OS keyring not available in bundle installs; install via npm for keyring storage, or set APIFY_DISABLE_KEYRING=1 to silence)`;
+		} else {
+			tokenLocation = `${AUTH_FILE_PATH()} (OS keyring unavailable; set APIFY_DISABLE_KEYRING=1 to silence)`;
+		}
 		success({
-			message: `You are logged in to Apify as ${userInfo.username || userInfo.id}. ${chalk.gray(`Your token is stored at ${AUTH_FILE_PATH()}.`)}`,
+			message: `You are logged in to Apify as ${userInfo.username || userInfo.id}. ${chalk.gray(`Your token is stored in ${tokenLocation}.`)}`,
 		});
 	} else {
 		error({

src/commands/auth/logout.ts

@@ -1,5 +1,6 @@
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { AUTH_FILE_PATH } from '../../lib/consts.js';
+import { clearKeyringSecrets } from '../../lib/credentials.js';
 import { rimrafPromised } from '../../lib/files.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
 import { success } from '../../lib/outputs.js';
@@ -24,6 +25,7 @@ export class AuthLogoutCommand extends ApifyCommand<typeof AuthLogoutCommand> {
 	static override docsUrl = 'https://docs.apify.com/cli/docs/reference#apify-logout';
 
 	async run() {
+		await clearKeyringSecrets();
 		await rimrafPromised(AUTH_FILE_PATH());
 
 		await updateUserId(null);

src/lib/actor.ts

@@ -57,7 +57,7 @@ export const getApifyStorageClient = async (
 	const apifyToken = await getApifyTokenFromEnvOrAuthFile();
 
 	return new ApifyClient({
-		...getApifyClientOptions(apifyToken),
+		...(await getApifyClientOptions(apifyToken)),
 		...options,
 	});
 };