4) get login from env every time

[jcofield]

What

Read login credential from os.environ every time

Why

This will reduce the surface area of credentials to only the process's os.evniron

How

Read directly from os.enrion every time a credential is necessary, e.g. the first login or to refresh a token.

[sam-watttime]

I worry that some users will not be sophisticated enough to set environment variables (e.g. windows power shell) we should check in with @geoffhancock to gauge this.

[geoffhancock]

I worry that some users will not be sophisticated enough to set environment variables (e.g. windows power shell) we should check in with @geoffhancock to gauge this.

I would guess it is a mix, and even if a majority know how, it is unlikely that everyone knows how to do it. It is actually quite easy to do in Windows, but not everyone has necessarily been exposed to it. Requiring it might be asking too much, but I like the approach of allowing both ways and nudging toward using envars.

[jcofield]

I worry that some users will not be sophisticated enough to set environment variables (e.g. windows power shell) we should check in with @geoffhancock to gauge this.

I would guess it is a mix, and even if a majority know how, it is unlikely that everyone knows how to do it. It is actually quite easy to do in Windows, but not everyone has necessarily been exposed to it. Requiring it might be asking too much, but I like the approach of allowing both ways and nudging toward using envars.

The intent here is to not change behavior at all but to reduce the surface area over which these parameters exist. If it cannot be done with this approach my next approach will be to try the system keyring. As a last resort, I would suggest we revisit this discussion and explore changing this functionality.