On Windows your credentials can live in Credential Manager, but only if you force it on.
Windows Credential Manager storage is built but off unless the cached tengu_windows_credman flag is true or CLAUDE_CODE_FORCE_WINDOWS_CREDMAN=1.
tengu_windows_credman Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.246: not a boolean we can read
Read once, for one account on one subscription tier, against v2.1.246. It isn't a statement about your account. What a flag value here can and cannot tell you
What's wrong with this entry?
On Windows, Claude Code can keep your credentials in the operating system's Credential Manager instead of its previous store. The choice is made by a resolver that answers once and reuses that answer for the rest of the run, so the backend cannot change mid-session. It stays off unless a remotely delivered feature flag named tengu_windows_credman is cached as true in your config file or you set CLAUDE_CODE_FORCE_WINDOWS_CREDMAN=1, which overrides the flag; with neither, the old credential store keeps being used.
- The environment variable is checked first and wins immediately, but only when the value is exactly the string
1; anything else falls through to the flag. - The flag is read synchronously from the cached feature list in the config file, preferring the legacy config path when one exists and otherwise using the current one.
- Config start-up can prime the resolver with the value from the on-disk feature cache through
primeWindowsCredManBackendEnabled, saving the resolver from reading the file itself. - With no cached feature, no primed value and no forcing environment variable, the answer is false, and any error while reading is also treated as false rather than surfaced.
- A test-only hook for swapping the storage backend is present in the shipped module but switched off outside tests: calling it in a production build throws
__setSecureStorageForTesting called outside test build. - To opt in for a session:
CLAUDE_CODE_FORCE_WINDOWS_CREDMAN=1 claude.
if (process.env.CLAUDE_CODE_FORCE_WINDOWS_CREDMAN === "1") return !0;, __setSecureStorageForTesting called outside test build
Strings lifted out of the shipped bundle, so the claim above can be checked against them.