Windows failure when adding OAuth alias: keychain “password encoded as UTF-16” exceeds 2560 chars

[sonisoft-cnanda]

Title: Windows failure when adding OAuth alias: keychain “password encoded as UTF-16” exceeds 2560 chars

Summary

When running now-sdk auth --add <instance> --type oauth on Windows, adding an additional ServiceNow SDK OAuth credential alias fails with:

ERROR: Attribute 'password encoded as UTF-16' is longer than platform limit of 2560 chars

After failure, now-sdk auth --list does not show the newly-added alias. I can confirm this is reproducible based on the number of existing stored aliases/tokens: removing one existing alias and then adding the previously failing alias works correctly.

Environment

• OS: Windows 11
• Node.js: 24.18.0
• Package versions from node_modules/@servicenow/sdk-cli/package.json:
  • @servicenow/sdk-cli: 4.11.2
  • @napi-rs/keyring: 1.2.0

Observed behavior

Adding OAuth credentials via interactive flow fails during credential persistence to OS keychain:

1. OAuth browser flow completes successfully:
   • “Successfully authenticated to instance …”
2. Then storing credentials fails:
   • ERROR: Attribute 'password encoded as UTF-16' is longer than platform limit of 2560 chars
3. The alias does not appear in now-sdk auth --list.

Expected behavior

now-sdk auth --add ... --type oauth should successfully store the OAuth alias on Windows regardless of the existing number of aliases (or at least fail with a clear actionable message and a supported workaround).

Reproduction steps

1. On Windows, ensure you have OAuth aliases stored (I currently had 3).
2. Attempt to add a 4th OAuth alias using:
   • now-sdk auth --add <instance> --type oauth
3. Complete OAuth login in browser and paste the code.
4. Observe failure and missing alias in now-sdk auth --list.

Confirmation

I removed one previous alias (so I had fewer stored aliases) and then added the one that was failing; it worked fine.

Investigation / likely root cause

@servicenow/sdk-cli appears to store all credential aliases inside one keychain “password” value by writing a single JSON blob.

Evidence from code

In @servicenow/sdk-cli, the keychain wrapper is initialized with a single service/account pair:

• node_modules/@servicenow/sdk-cli/src/auth/keychain/index.ts
  • private readonly account = 'now-sdk'
  • new Entry(this.service, this.account)

And credential persistence stores the entire alias map as one JSON string:

• node_modules/@servicenow/sdk-cli/src/auth/index.ts

await keyChain.setPassword(JSON.stringify(keyStore))

[venkat-kaluva]

Hi @sonisoft-cnanda, thanks for reporting this. We are aware of this limitation in windows and we do store as a single JSON Blob to avoid some issues in mac.

workaround for windows is to remove the existing credential before adding a new one

[sonisoft-cnanda]

Ya, I did do that, it is just hard since I work against 10-20 instances lol. Going to test out my @sonisoft/sn-credstore to see if I can use that to get around this a bit. I didn't design it for this though, but may be able to utilize that. Thanks!