Heroku CLI v11.8.0 now defaults to storing authentication credentials in the system keychain instead of the .netrc file. The update uses OS-native secure storage on macOS (Keychain Access), Linux (Secret Service API via secret-tool), and Windows (PasswordVault/Credential Manager). A four-tier credential lookup order is maintained: HEROKU_API_KEY env var, HEROKU_NETRC_WRITE env var, system keychain, then .netrc fallback. Existing workflows like git push heroku main remain unchanged thanks to a new git credential helper. CI/CD pipelines using HEROKU_API_KEY require no changes, and .netrc support is preserved for custom integrations via the HEROKU_NETRC_WRITE=true flag.
Table of contents
Secure credential storage leveraging native system toolsMaintaining netrc supportGit integrationDeveloper experienceA more secure Heroku CLI243 Impressions