toolhive with Keyctl won't ask password again if first mistaken
Open
@JAORMX is already working on this.
Since Jan 19, 2026.
authentication
bug
cli
- Dominant language
- Go
- Stars
- 2.2k
- Forks
- 300
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 184
Description
Bug description
I have Keyctl enable and working. I can list/get/set secrets. On reboot, on first get toolhive request the keyctl password again. If I mistype, all following invocation will fail. The only workaround I could find is to reboot.
Steps to reproduce
❯ toolhive secret get github
5:18PM INFO Using keyring provider: Linux Keyctl
ToolHive needs a password to secure your credentials in the OS keyring.
This password will be used to encrypt and decrypt API tokens and other secrets
that need to be accessed by MCP servers. It will be securely stored in your OS keyring
so you won't need to enter it each time.
Please enter your keyring password:
5:18PM INFO writing password to Linux Keyctl
Error: failed to create secrets manager: failed to create secrets manager: unable to decrypt secrets file: cipher: message authentication failed
~
❯ toolhive secret get github
5:18PM INFO Using keyring provider: Linux Keyctl
Error: failed to create secrets manager: failed to create secrets manager: unable to decrypt secrets file: cipher: message authentication failed
Expected behavior
I expect to have a second chance at typing my password.
Actual behavior
I can't retry before rebooting.
Environment (if relevant)
- OS/version: Linux under WSL
- ToolHive version: v0.7.1 73d4f262da88e290b9ce82683996cfdf838db432
Additional context
Any additional information or logs you think might help.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.