Skip to main content
Watchfire
SecretsWorks

OS keyring (macOS Keychain, libsecret)

Where Watchfire stores its own outbound adapter credentials.

What is OS keyring (macOS Keychain, libsecret)?

Watchfire stores its own adapter credentials in the host's OS keyring — not your application secrets, but the tokens Watchfire itself uses to talk to Slack, GitHub, and webhooks.

OS keyring (macOS Keychain, libsecret) + Watchfire

  • Outbound adapter credentials — webhook signing keys, Slack and Discord bot tokens, GitHub auto-PR tokens — are persisted in the OS keyring.
  • On macOS that's the system Keychain; on Linux it's libsecret via the Secret Service API; with an encrypted file-store fallback when neither is available.
  • Secrets are written via the gRPC surface and never read back over the wire — clients see opaque references, not the values themselves.

Related docs

Other secrets integrations

Works

1Password / Bitwarden / pass

Use your shell's secret tooling — Watchfire reads from the environment.

Read more
Works

.env files

Blocked by the sandbox on purpose — describe them in the instructions file instead.

Read more

See all integrations

Ready to go

Get started with Watchfire

Install in seconds. Define tasks. Let agents ship code for you.

Download for macOS

Available for macOS, Linux, and Windows

install
# Install via Homebrew (macOS)
$brew tap watchfire-io/tap
$brew install --cask watchfire-io/tap/watchfire
# Set up your project and go
$watchfire init
$watchfire task add "Build the login page"
$watchfire start --all

Includes GUI, CLI, and daemon. Also available via Homebrew.

View on GitHubRead the Docs