Preflight checklist
What problem does this solve?
Open Science cannot save API keys when the operating-system credential vault is unavailable.
This blocks API-key provider setup on common headless deployments, including Linux servers, WSL, containers, and SSH- or service-launched Open Science processes. These environments often have no accessible desktop keyring or a matching unlocked D-Bus session.
In this environment, Codex subscription authentication works because it uses separate file-backed authentication. However, adding or saving an API key for any API-key-based provider is unavailable: Open Science requires the operating-system credential vault for those credentials, and the vault is unavailable in the headless process.
Proposed solution
No specific implementation is proposed in this issue.
The request is for Open Science to support a secure, documented way to configure and persist API-key providers in headless Linux and WSL deployments, without weakening the application's credential-protection guarantees.
Alternatives considered
A manually started desktop keyring can be difficult to keep available for a server, WSL, container, or service process because it depends on an unlocked keyring and matching D-Bus session.
Additional context
This affects the production headless web UI, not only development or test environments.
PR #808 enabled a basic password backend only for Linux E2E test profiles. It explicitly did not change production secure-storage behavior.
Preflight checklist
What problem does this solve?
Open Science cannot save API keys when the operating-system credential vault is unavailable.
This blocks API-key provider setup on common headless deployments, including Linux servers, WSL, containers, and SSH- or service-launched Open Science processes. These environments often have no accessible desktop keyring or a matching unlocked D-Bus session.
In this environment, Codex subscription authentication works because it uses separate file-backed authentication. However, adding or saving an API key for any API-key-based provider is unavailable: Open Science requires the operating-system credential vault for those credentials, and the vault is unavailable in the headless process.
Proposed solution
No specific implementation is proposed in this issue.
The request is for Open Science to support a secure, documented way to configure and persist API-key providers in headless Linux and WSL deployments, without weakening the application's credential-protection guarantees.
Alternatives considered
A manually started desktop keyring can be difficult to keep available for a server, WSL, container, or service process because it depends on an unlocked keyring and matching D-Bus session.
Additional context
This affects the production headless web UI, not only development or test environments.
PR #808 enabled a basic password backend only for Linux E2E test profiles. It explicitly did not change production secure-storage behavior.