{"version":"2.1.246","anchor":"windows-credential-manager-as-the-credential-store-gated-and","canonical_anchor":"windows-credential-manager-as-the-credential-store-gated-and","heading":"Windows Credential Manager as the credential store, gated and cached","tier":"use","area":"Credentials","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246\/e\/windows-credential-manager-as-the-credential-store-gated-and","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246","markdown":"### Windows Credential Manager as the credential store, gated and cached\n\nOn Windows your credentials can live in Credential Manager, but only if you force it on.\n\n**What**\n\nOn Windows, Claude Code can keep your credentials in the operating system's Credential Manager instead of its previous store. The choice is made by a resolver that answers once and reuses that answer for the rest of the run, so the backend cannot change mid-session. It stays off unless a remotely delivered feature flag named `tengu_windows_credman` is cached as true in your config file or you set `CLAUDE_CODE_FORCE_WINDOWS_CREDMAN=1`, which overrides the flag; with neither, the old credential store keeps being used.\n\n**Details**\n\n- The environment variable is checked first and wins immediately, but only when the value is exactly the string `1`; anything else falls through to the flag.\n- The flag is read synchronously from the cached feature list in the config file, preferring the legacy config path when one exists and otherwise using the current one.\n- Config start-up can prime the resolver with the value from the on-disk feature cache through `primeWindowsCredManBackendEnabled`, saving the resolver from reading the file itself.\n- With no cached feature, no primed value and no forcing environment variable, the answer is false, and any error while reading is also treated as false rather than surfaced.\n- A test-only hook for swapping the storage backend is present in the shipped module but switched off outside tests: calling it in a production build throws `__setSecureStorageForTesting called outside test build`.\n- To opt in for a session: `CLAUDE_CODE_FORCE_WINDOWS_CREDMAN=1 claude`.\n\n**Evidence**\n\n`if (process.env.CLAUDE_CODE_FORCE_WINDOWS_CREDMAN === \"1\") return !0;`, `__setSecureStorageForTesting called outside test build`\n\n- Flag `tengu_windows_credman`: Off in both readings (read for one account on one subscription tier against v2.1.246; this account: off, anonymous baseline: off, compiled default: not a boolean we can read)\n- Area: Credentials\n- Names: `CLAUDE_CODE_FORCE_WINDOWS_CREDMAN`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}