granted credentials list fails with "The specified item could not be found in the keyring" while stored credentials remain retrievable

[brianhelba]

Issue Description

granted credentials list exits with an error on my Linux setup, even though the IAM user credentials it should list are stored and fully usable: credential_process retrieval for every stored profile works (verified with aws sts get-caller-identity for each one).

The command fails with:

[✘] The specified item could not be found in the keyring

Environment detail that may be relevant: Granted is configured with the secret-service backend and LibSecretCollectionName = "login". That gnome-keyring collection is shared with other desktop applications, but all Granted items were created via granted credentials import. The other items include secrets from browsers, Slack, gh, and other tools.

I searched existing Issues and Discussions before posting. Issues #844 and #781 show the same error text, but both concern IAM Identity Center token retrieval during assume/credential-process, not credentials list, and both are closed. I found no existing report for the credentials list case.

Expected Behavior

The command prints the profile names of the IAM user credentials in secure storage, matching its usage text: "Lists the profile names for credentials in secure storage".

Actual Behavior

The command prints [✘] The specified item could not be found in the keyring and exits 1. No profile names are printed.

The stored credentials themselves are unaffected: AWS_PROFILE=<name> aws sts get-caller-identity succeeds for all profiles via their credential_process config entries.

Reproduction Steps

1. Linux desktop with gnome-keyring, using the secret-service backend and the default login collection (see config below). The login collection also contains secrets stored by other applications (browsers, etc.), as is normal on a desktop system.
2. Import (or add) an IAM user credential, e.g. granted credentials import personal — succeeds.
3. Confirm the credential works: AWS_PROFILE=personal aws sts get-caller-identity — succeeds.
4. Run granted credentials list.
5. Observe the keyring error and exit code 1 instead of a profile listing.

Granted Logs

$ GRANTED_LOG=debug granted credentials list
2026/08/13 21:22:40 [keyring] Considering backends: [secret-service]
[✘] The specified item could not be found in the keyring
$ echo $?
1

(ANSI color codes stripped.)

Granted Version

Granted version: 0.39.0

OS Version Information

CachyOS Linux (Arch-based, rolling), kernel 7.1.6, gnome-keyring 50.0

Minimal Granted & AWS Config Configuration

# ~/.granted/config
[Keyring]
  Backend = "secret-service"
  LibSecretCollectionName = "login"

# ~/.aws/config
[profile personal]
credential_process = granted credential-process --profile=personal
region = us-east-1

Additional Relevant Configuration

aws-cli 2.34.32. The credentials were imported with granted credentials import <profile> from a standard ~/.aws/credentials file; the import reported success and removed the plaintext entries. granted credentials list has failed consistently since, while credential retrieval keeps working.

I acknowledge that:

• I have reviewed the FAQ and confirm that my issue is NOT among them.
• I have searched the Granted repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
• I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (```) on separate lines.