---
title: "Securing Heroku CLI Credentials with System Keychain Storage"
url: https://daily.dev/posts/securing-heroku-cli-credentials-with-system-keychain-storage-ki29iioto
source_url: https://www.heroku.com/blog/securing-heroku-cli-credentials-with-system-keychain-storage
type: article
source: "Heroku"
published: 2026-07-01T21:18:44.640Z
updated: 2026-07-01T21:19:08.079Z
tags: ["security", "cli", "heroku"]
reading_time: 6
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing Heroku CLI Credentials with System Keychain Storage

**[Heroku](https://daily.dev/sources/heroku)** · 6 min read · 0 upvotes · 0 comments

## Summary

Heroku CLI v11.8.0 now defaults to storing authentication credentials in the system keychain instead of the .netrc file. The update uses OS-native secure storage on macOS (Keychain Access), Linux (Secret Service API via secret-tool), and Windows (PasswordVault/Credential Manager). A four-tier credential lookup order is maintained: HEROKU_API_KEY env var, HEROKU_NETRC_WRITE env var, system keychain, then .netrc fallback. Existing workflows like git push heroku main remain unchanged thanks to a new git credential helper. CI/CD pipelines using HEROKU_API_KEY require no changes, and .netrc support is preserved for custom integrations via the HEROKU_NETRC_WRITE=true flag.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.heroku.com/blog/securing-heroku-cli-credentials-with-system-keychain-storage>

## Similar posts on daily.dev

- [Stop Putting Secrets in .env Files](https://daily.dev/posts/stop-putting-secrets-in-env-files-yml3clr0r) · Lobsters · 2 upvotes · 0 comments
- [Modernizing the Command Line: Heroku CLI v11](https://daily.dev/posts/modernizing-the-command-line-heroku-cli-v11-2swwgps9c) · Heroku · 2 upvotes · 1 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cli](https://daily.dev/tags/cli), [#heroku](https://daily.dev/tags/heroku)

[View this post on daily.dev](https://daily.dev/posts/securing-heroku-cli-credentials-with-system-keychain-storage-ki29iioto)