@dotenvx/dotenvx 2.7.0 → 2.7.1

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.7.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.7.1...main)
+
+## [2.7.1](https://github.com/dotenvx/dotenvx/compare/v2.7.0...v2.7.1) (2026-07-13)
+
+### Changed
+
+* Security Improvement: `dotenvx armor login` attempts to set the `DOTENVX_ARMOR_TOKEN` in your native OS secret store going forward. For current Armor users run `dotenvx armor logout` and then `dotenvx armor login` to make use of this immediately. ([#886](https://github.com/dotenvx/dotenvx/pull/886))
 
 ## [2.7.0](https://github.com/dotenvx/dotenvx/compare/v2.6.0...v2.7.0) (2026-07-13)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.7.0",
+  "version": "2.7.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/settings/device.js

@@ -0,0 +1,23 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+const mask = require('../../../lib/helpers/mask')
+
+function device () {
+  const options = this.opts()
+
+  try {
+    const value = new Session().devicePublicKey()
+    if (value && value.length > 1) {
+      console.log(options.unmask ? value : mask(value, 6))
+      return
+    }
+
+    logger.error('missing device. Try generating one with [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = device

package/src/cli/actions/settings/hostname.js

@@ -0,0 +1,20 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function hostname () {
+  try {
+    const value = new Session().hostname()
+    if (value && value.length > 1) {
+      console.log(value)
+      return
+    }
+
+    logger.error('missing hostname. Try running [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = hostname

package/src/cli/actions/settings/off.js

@@ -0,0 +1,14 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function off () {
+  try {
+    new Session().turnOff()
+    logger.success('✔ armor: off')
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = off

package/src/cli/actions/settings/on.js

@@ -0,0 +1,14 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function on () {
+  try {
+    new Session().turnOn()
+    logger.success('✔ armor: on')
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = on

package/src/cli/actions/settings/path.js

@@ -0,0 +1,20 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function path () {
+  try {
+    const value = new Session().path()
+    if (value && value.length > 1) {
+      console.log(value)
+      return
+    }
+
+    logger.error('missing path. Try running [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = path

package/src/cli/actions/settings/token.js

@@ -0,0 +1,23 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+const mask = require('../../../lib/helpers/mask')
+
+function token () {
+  const options = this.opts()
+
+  try {
+    const value = new Session().token()
+    if (value && value.length > 1) {
+      console.log(options.unmask ? value : mask(value))
+      return
+    }
+
+    logger.error('missing token. Try generating one with [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = token

package/src/cli/actions/settings/username.js

@@ -0,0 +1,20 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function username () {
+  try {
+    const value = new Session().username()
+    if (value) {
+      console.log(value)
+      return
+    }
+
+    logger.error('login required. Try running [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = username

package/src/cli/commands/armor.js

@@ -91,6 +91,9 @@ function configureArmorCommand (armor) {
       return require('./../actions/logout').apply(this, args)
     })
 
+  // dotenvx armor settings
+  require('./settings')(armor.command('settings'))
+
   return armor
 }
 

package/src/cli/commands/lock.js

@@ -1,4 +1,10 @@
 function configureLockCommand (lock) {
+  lock.hook('preAction', async () => {
+    const Session = require('./../../db/session')
+    const sesh = new Session()
+    await sesh.notifyUpdate()
+  })
+
   lock
     .description('lock private keys with a local passphrase')
     .action(function () {

package/src/cli/commands/native.js

@@ -1,4 +1,10 @@
 function configureNativeCommand (native) {
+  native.hook('preAction', async () => {
+    const Session = require('./../../db/session')
+    const sesh = new Session()
+    await sesh.notifyUpdate()
+  })
+
   native
     .description('move private keys into your OS secret store')
     .action(function () {

package/src/cli/commands/settings.js

@@ -0,0 +1,62 @@
+function configureSettingsCommand (settings) {
+  settings
+    .description('settings')
+    .action(function () {
+      this.help()
+    })
+
+  settings
+    .command('username')
+    .description('print your username')
+    .action(function (...args) {
+      return require('./../actions/settings/username').apply(this, args)
+    })
+
+  settings
+    .command('token')
+    .description('print your access token (--unmask)')
+    .option('--unmask', 'unmask access token')
+    .action(function (...args) {
+      return require('./../actions/settings/token').apply(this, args)
+    })
+
+  settings
+    .command('device')
+    .description('print your device pubkey (--unmask)')
+    .option('--unmask', 'unmask device pubkey')
+    .action(function (...args) {
+      return require('./../actions/settings/device').apply(this, args)
+    })
+
+  settings
+    .command('hostname')
+    .description('print hostname')
+    .action(function (...args) {
+      return require('./../actions/settings/hostname').apply(this, args)
+    })
+
+  settings
+    .command('path')
+    .description('print path to settings file')
+    .action(function (...args) {
+      return require('./../actions/settings/path').apply(this, args)
+    })
+
+  settings
+    .command('on')
+    .description('turn armor on')
+    .action(function (...args) {
+      return require('./../actions/settings/on').apply(this, args)
+    })
+
+  settings
+    .command('off')
+    .description('turn armor off')
+    .action(function (...args) {
+      return require('./../actions/settings/off').apply(this, args)
+    })
+
+  return settings
+}
+
+module.exports = configureSettingsCommand

package/src/db/session.js

@@ -5,6 +5,7 @@ const { Conf, dotenv, envPaths } = require('@dotenvx/tooling')
 const jsonToEnv = require('./../lib/helpers/jsonToEnv')
 const packageJson = require('./../lib/helpers/packageJson')
 const { http } = require('./../lib/helpers/http')
+const nativeProvider = require('./../lib/providers/native')
 const { logger } = require('./../shared/logger')
 
 const HOURS_24 = 60 * 60 * 24 * 1000
@@ -14,7 +15,8 @@ const ARMOR = {
   HOSTNAME: 'DOTENVX_ARMOR_HOSTNAME',
   USER: 'DOTENVX_ARMOR_USER',
   USERNAME: 'DOTENVX_ARMOR_USERNAME',
-  TOKEN: 'DOTENVX_ARMOR_TOKEN'
+  TOKEN: 'DOTENVX_ARMOR_TOKEN',
+  ON: 'DOTENVX_ARMOR_ON'
 }
 
 const DOTENVX = {
@@ -100,7 +102,7 @@ class Session {
 
   status () {
     // if logged in
-    if (this.username() && this.token()) {
+    if (this.username() && this.token() && this.on()) {
       return 'on'
     }
 
@@ -133,7 +135,15 @@ class Session {
   }
 
   token () {
-    return this.readSetting('TOKEN') || undefined
+    return this.getFromSecretStore(ARMOR.TOKEN) || undefined
+  }
+
+  on () {
+    return (this.readSetting('ON') || 'true') === 'true'
+  }
+
+  off () {
+    return (this.readSetting('ON') || 'true') === 'false'
   }
 
   devicePublicKey () {
@@ -187,7 +197,7 @@ class Session {
       store.set(DOTENVX.VERSION_LAST_CHECK, now)
 
       if (versionGreaterThan(remote, packageJson.version)) {
-        console.error('⛆ update available [npm install @dotenvx/dotenvx@latest]')
+        console.error('⛆ update available [curl -sfS https://dotenvx.sh | sh]')
       }
     } catch (error) {
       logger.debug(error.message)
@@ -222,6 +232,47 @@ class Session {
   //
   // Set/Delete
   //
+  getFromSecretStore (key) {
+    try {
+      const value = nativeProvider.get(key)
+      if (value) return value
+    } catch {}
+
+    const store = this.openStore()
+    if (!store) return undefined
+
+    return store.get(key)
+  }
+
+  setInSecretStore (key, value) {
+    try {
+      nativeProvider.set(key, value)
+      return value
+    } catch {
+      this.createStore().set(key, value)
+      return value
+    }
+  }
+
+  deleteFromSecretStore (key) {
+    try {
+      nativeProvider.delete(key)
+    } catch {}
+
+    const store = this.openStore()
+    if (store) store.delete(key)
+  }
+
+  turnOn () {
+    this.createStore().set(ARMOR.ON, 'true')
+    return 'true'
+  }
+
+  turnOff () {
+    this.createStore().set(ARMOR.ON, 'false')
+    return 'false'
+  }
+
   login (hostname, id, username, accessToken) {
     if (!hostname) {
       throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx armor login]')
@@ -242,8 +293,9 @@ class Session {
     const store = this.createStore()
     store.set(ARMOR.USER, id)
     store.set(ARMOR.USERNAME, username)
-    store.set(ARMOR.TOKEN, accessToken)
+    this.setInSecretStore(ARMOR.TOKEN, accessToken)
     store.set(ARMOR.HOSTNAME, hostname)
+    store.set(ARMOR.ON, 'true')
 
     return accessToken
   }
@@ -261,13 +313,14 @@ class Session {
       throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx armor login]')
     }
 
+    this.deleteFromSecretStore(ARMOR.TOKEN)
+
     const store = this.openStore()
     if (!store) return true
-
     store.delete(ARMOR.USER)
     store.delete(ARMOR.USERNAME)
-    store.delete(ARMOR.TOKEN)
     store.delete(ARMOR.HOSTNAME)
+    store.delete(ARMOR.ON)
     store.delete(DOTENVX.VERSION)
     store.delete(DOTENVX.VERSION_LAST_CHECK)
     return true

package/src/lib/helpers/linuxSecretService.js

@@ -7,7 +7,7 @@ function attributes (publicKey) {
   return ['service', SERVICE, 'public-key', publicKey]
 }
 
-function findGenericPassword (publicKey) {
+function get (publicKey) {
   try {
     return execFileSync(SECRET_TOOL_BIN, ['lookup', ...attributes(publicKey)], {
       encoding: 'utf8',
@@ -18,7 +18,7 @@ function findGenericPassword (publicKey) {
   }
 }
 
-function addGenericPassword (publicKey, label, privateKey) {
+function set (publicKey, privateKey, label) {
   try {
     execFileSync(SECRET_TOOL_BIN, ['store', `--label=${label}`, ...attributes(publicKey)], {
       input: privateKey,
@@ -30,14 +30,16 @@ function addGenericPassword (publicKey, label, privateKey) {
   }
 }
 
-function deleteGenericPassword (publicKey) {
-  try {
-    execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
-      stdio: ['ignore', 'ignore', 'pipe']
-    })
-  } catch {
-    throw new Error('failed to delete private key from Linux Secret Service')
+module.exports = {
+  get,
+  set,
+  delete (publicKey) {
+    try {
+      execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
+        stdio: ['ignore', 'ignore', 'pipe']
+      })
+    } catch {
+      throw new Error('failed to delete private key from Linux Secret Service')
+    }
   }
 }
-
-module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/helpers/macosKeychain.js

@@ -0,0 +1,26 @@
+const { execFileSync } = require('child_process')
+
+const SECURITY_BIN = '/usr/bin/security'
+const SERVICE = 'dotenvx'
+
+module.exports = {
+  get (key) {
+    return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', key, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+  },
+
+  set (key, value, label) {
+    try {
+      execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', key, '-l', label, '-w', value], { stdio: 'ignore' })
+    } catch {
+      throw new Error('failed to save private key to macOS Keychain')
+    }
+  },
+
+  delete (key) {
+    try {
+      execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', key], { stdio: 'ignore' })
+    } catch {
+      throw new Error('failed to delete private key from macOS Keychain')
+    }
+  }
+}

package/src/lib/helpers/windowsCredentialManager.js

@@ -134,7 +134,7 @@ function run (payload) {
   })
 }
 
-function findGenericPassword (publicKey) {
+function get (publicKey) {
   try {
     return run({ action: 'read', target: target(publicKey) }).trim() || null
   } catch {
@@ -142,7 +142,7 @@ function findGenericPassword (publicKey) {
   }
 }
 
-function addGenericPassword (publicKey, privateKey) {
+function set (publicKey, privateKey) {
   try {
     run({ action: 'write', target: target(publicKey), username: publicKey, secret: privateKey })
   } catch {
@@ -150,12 +150,14 @@ function addGenericPassword (publicKey, privateKey) {
   }
 }
 
-function deleteGenericPassword (publicKey) {
-  try {
-    run({ action: 'delete', target: target(publicKey) })
-  } catch {
-    throw new Error('failed to delete private key from Windows Credential Manager')
+module.exports = {
+  get,
+  set,
+  delete (publicKey) {
+    try {
+      run({ action: 'delete', target: target(publicKey) })
+    } catch {
+      throw new Error('failed to delete private key from Windows Credential Manager')
+    }
   }
 }
-
-module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/providers/native/index.js

@@ -1,27 +1,52 @@
-const { execFileSync } = require('child_process')
-
+const macosKeychain = require('../../helpers/macosKeychain')
 const windowsCredentialManager = require('../../helpers/windowsCredentialManager')
 const linuxSecretService = require('../../helpers/linuxSecretService')
 
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
+function get (key) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.get(key)
+  }
 
-function findMacosPrivateKey (publicKeyHex) {
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKeyHex, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+  if (process.platform === 'linux') {
+    return linuxSecretService.get(key)
+  }
+
+  return macosKeychain.get(key)
+}
+
+function set (key, value, label = key) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.set(key, value, label)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.set(key, value, label)
+    return
+  }
+
+  macosKeychain.set(key, value, label)
+}
+
+index.delete = function (key) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.delete(key)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.delete(key)
+    return
+  }
+
+  macosKeychain.delete(key)
 }
 
 function index (publicKeyHex) {
   if (!['darwin', 'linux', 'win32'].includes(process.platform)) return {}
 
   try {
-    let privateKeyHex
-    if (process.platform === 'win32') {
-      privateKeyHex = windowsCredentialManager.findGenericPassword(publicKeyHex)
-    } else if (process.platform === 'linux') {
-      privateKeyHex = linuxSecretService.findGenericPassword(publicKeyHex)
-    } else {
-      privateKeyHex = findMacosPrivateKey(publicKeyHex)
-    }
+    const privateKeyHex = get(publicKeyHex)
 
     if (!privateKeyHex) return {}
 
@@ -31,4 +56,7 @@ function index (publicKeyHex) {
   }
 }
 
+index.set = set
+index.get = get
+
 module.exports = index

package/src/lib/services/keychainDown.js

@@ -1,40 +1,8 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
-
-function deleteGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.deleteGenericPassword(publicKey)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.deleteGenericPassword(publicKey)
-    return
-  }
-
-  execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainDown {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -55,7 +23,7 @@ class KeychainDown {
     let privateKey
 
     try {
-      privateKey = findGenericPassword(publicKey)
+      privateKey = nativeProvider.get(publicKey)
       if (!privateKey) {
         const secretStore = process.platform === 'win32'
           ? 'Windows Credential Manager'
@@ -78,7 +46,7 @@ class KeychainDown {
     }
 
     upsertEnvKey(privateKeyName, privateKey, envKeysFile)
-    deleteGenericPassword(publicKey)
+    nativeProvider.delete(publicKey)
 
     return {
       changed: true,

package/src/lib/services/keychainPull.js

@@ -1,26 +1,8 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainPull {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -41,7 +23,7 @@ class KeychainPull {
     let privateKey
 
     try {
-      privateKey = findGenericPassword(publicKey)
+      privateKey = nativeProvider.get(publicKey)
       if (!privateKey) throw new Error('not found')
     } catch {
       const secretStore = process.platform === 'win32'

package/src/lib/services/keychainPush.js

@@ -1,43 +1,7 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function addGenericPassword (publicKey, label, privateKey) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
-    return
-  }
-
-  try {
-    execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
-  } catch {
-    throw new Error('failed to save private key to macOS Keychain')
-  }
-}
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainPush {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -59,7 +23,7 @@ class KeychainPush {
     const label = `dotenvx (${armoredKeyDisplay(publicKey)})`
 
     try {
-      const existingPrivateKey = findGenericPassword(publicKey)
+      const existingPrivateKey = nativeProvider.get(publicKey)
 
       if (existingPrivateKey === privateKey) {
         return {
@@ -72,7 +36,7 @@ class KeychainPush {
       }
     } catch {}
 
-    addGenericPassword(publicKey, label, privateKey)
+    nativeProvider.set(publicKey, privateKey, label)
 
     return {
       changed: true,

package/src/lib/services/keychainUp.js

@@ -1,44 +1,8 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const removeEnvKey = require('../helpers/removeEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function addGenericPassword (publicKey, label, privateKey) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
-    return
-  }
-
-  try {
-    execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
-  } catch {
-    throw new Error('failed to save private key to macOS Keychain')
-  }
-}
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainUp {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -60,7 +24,7 @@ class KeychainUp {
     let existingPrivateKey
 
     try {
-      existingPrivateKey = findGenericPassword(publicKey)
+      existingPrivateKey = nativeProvider.get(publicKey)
     } catch {}
 
     const privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: !existingPrivateKey })
@@ -89,7 +53,7 @@ class KeychainUp {
       }
     }
 
-    addGenericPassword(publicKey, label, privateKey)
+    nativeProvider.set(publicKey, privateKey, label)
     removeEnvKey(privateKeyName, envKeysFile)
 
     return {