granted sso login does not respect ExportSSOToken = true

[IskanderNovena]

Summary

The ExportSSOToken = true config setting works correctly with assume, but granted sso login does not export the SSO token to ~/.aws/sso/cache/. This means tools that rely on the AWS CLI's plaintext token cache (Terraform, AWS SDKs, SSM Session Manager plugin, etc.) don't pick up the token after a standalone granted sso login.

Expected behavior

When ExportSSOToken = true is set in ~/.granted/config, both assume and granted sso login should write the SSO token to ~/.aws/sso/cache/.

Actual behavior

• assume my-profile correctly exports the token: [✔] Exported sso token to ~/.aws/sso/cache
• granted sso login --sso-start-url https://example.awsapps.com/start --sso-region eu-west-1 stores the token only in the macOS keychain and does not write to ~/.aws/sso/cache/

Reproduction

1. Set ExportSSOToken = true in ~/.granted/config
2. Run granted sso login --sso-start-url https://example.awsapps.com/start --sso-region eu-west-1
3. Complete the browser auth flow
4. Check ~/.aws/sso/cache/ - no new/updated access token file is present
5. Run assume my-profile for a profile using the same start URL
6. Check ~/.aws/sso/cache/ - token file is now present

Additional observation: trailing slash mismatch

There's also a trailing slash inconsistency between the two commands:

• granted sso login stores the token in keychain under account https://example.awsapps.com/start (no trailing slash)
• assume looks up the token under https://example.awsapps.com/start/ (with trailing slash)

This means a granted sso login session is not found by a subsequent assume, forcing a re-authentication even though a valid token exists in the keychain.

Environment

• macOS (Apple Silicon)
• Granted v0.39.0 (Homebrew)
• Keyring backend: keychain

Config (~/.granted/config)

ExportSSOToken = true
CredentialProcessAutoLogin = true
[Keyring]
  Backend = "keychain"

AWS profile (~/.aws/config)

[profile my-profile]
sso_start_url  = https://example.awsapps.com/start/
sso_region     = eu-west-1
sso_account_id = 123456789012
sso_role_name  = MyRole
region         = eu-west-1

[IskanderNovena]

Verbose logs

granted sso login (does NOT export to ~/.aws/sso/cache/)

❯ granted --verbose sso login --sso-start-url https://example.awsapps.com/start --sso-region eu-west-1
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Arc/User Data/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Google/Chrome/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Google/Chrome Beta/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Google/Chrome Canary/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Google/Chrome Dev/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Microsoft Edge/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Microsoft Edge Beta/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Microsoft Edge Canary/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Microsoft Edge Dev/NativeMessagingHosts/io.commonfate.granted.json
[DEBUG] wrote native messaging manifest: /Users/user/Library/Application Support/Vivaldi/NativeMessagingHosts/io.commonfate.granted.json
2026/08/17 10:05:18 [keyring] Considering backends: [keychain]
2026/08/17 10:05:18 [keyring] Querying keychain for service="granted-aws-idc-user-codes", account="codes", keychain="login.keychain"
2026/08/17 10:05:18 [keyring] Found item "granted-aws-idc-user-codes"
[DEBUG] retrieve user codes from keychain  	codes:{Codes:[{Code:XXXX-XXXX Expiry:2026-08-17 10:08:43.516029 +0200 CEST}]}
[DEBUG] storing user codes in keychain  	codes:{Codes:[{Code:XXXX-XXXX Expiry:2026-08-17 10:08:43.516029 +0200 CEST} {Code:YYYY-YYYY Expiry:2026-08-17 10:15:18.586358 +0200 CEST m=+600.320681293}]}
2026/08/17 10:05:18 [keyring] Considering backends: [keychain]
2026/08/17 10:05:18 [keyring] Checking keychain status
2026/08/17 10:05:18 [keyring] Keychain status returned nil, keychain exists
2026/08/17 10:05:18 [keyring] Keychain item trusts keyring
2026/08/17 10:05:18 [keyring] Adding service="granted-aws-idc-user-codes", label="", account="codes", trusted=true to osx keychain "login.keychain"
2026/08/17 10:05:18 [keyring] Item already exists, updating
[i] If the browser does not open automatically, please open this link: https://example.awsapps.com/start/#/device?user_code=YYYY-YYYY
[i] Awaiting AWS authentication in the browser
[i] You will be prompted to authenticate with AWS in the browser, then you will be prompted to 'Allow'
[i] Code: YYYY-YYYY
2026/08/17 10:05:23 [keyring] Considering backends: [keychain]
2026/08/17 10:05:23 [keyring] Checking keychain status
2026/08/17 10:05:23 [keyring] Keychain status returned nil, keychain exists
2026/08/17 10:05:23 [keyring] Keychain item trusts keyring
2026/08/17 10:05:23 [keyring] Adding service="granted-aws-sso-tokens", label="", account="https://example.awsapps.com/start", trusted=true to osx keychain "login.keychain"
2026/08/17 10:05:23 [keyring] Item already exists, updating

Note: no [✔] Exported sso token to ~/.aws/sso/cache line appears.

assume (correctly exports to ~/.aws/sso/cache/)

❯ assume --verbose my-profile
...(native messaging manifests omitted for brevity)...
[DEBUG] checking if autosync has been run for the day
[DEBUG] skipping profile registry sync until tomorrow
[DEBUG] process args  	execFlag:	osargs:[assumego,--verbose,my-profile]	c.args:[my-profile]
[DEBUG] processed profile name my-profile
[DEBUG] exec config:<nil>
2026/08/17 10:14:58 [keyring] Considering backends: [keychain]
2026/08/17 10:14:58 [keyring] Querying keychain for service="granted-aws-sso-tokens", account="https://example.awsapps.com/start/", keychain="login.keychain"
2026/08/17 10:14:58 [keyring] No results found
[!] error retrieving IAM Identity Center token from secure storage: The specified item could not be found in the keyring
2026/08/17 10:14:58 [keyring] Considering backends: [keychain]
2026/08/17 10:14:58 [keyring] Querying keychain for service="granted-aws-idc-user-codes", account="codes", keychain="login.keychain"
2026/08/17 10:14:58 [keyring] Found item "granted-aws-idc-user-codes"
[DEBUG] retrieve user codes from keychain  	codes:{Codes:[{Code:YYYY-YYYY Expiry:2026-08-17 10:15:18.586358 +0200 CEST}]}
[DEBUG] storing user codes in keychain  	codes:{Codes:[{Code:YYYY-YYYY Expiry:2026-08-17 10:15:18.586358 +0200 CEST} {Code:ZZZZ-ZZZZ Expiry:2026-08-17 10:24:58.559946 +0200 CEST m=+600.227854001}]}
2026/08/17 10:14:58 [keyring] Considering backends: [keychain]
2026/08/17 10:14:58 [keyring] Checking keychain status
2026/08/17 10:14:58 [keyring] Keychain status returned nil, keychain exists
2026/08/17 10:14:58 [keyring] Keychain item trusts keyring
2026/08/17 10:14:58 [keyring] Adding service="granted-aws-idc-user-codes", label="", account="codes", trusted=true to osx keychain "login.keychain"
2026/08/17 10:14:58 [keyring] Item already exists, updating
[i] If the browser does not open automatically, please open this link: https://example.awsapps.com/start/#/device?user_code=ZZZZ-ZZZZ
[i] Awaiting AWS authentication in the browser
[i] Code: ZZZZ-ZZZZ
2026/08/17 10:15:03 [keyring] Considering backends: [keychain]
2026/08/17 10:15:03 [keyring] Checking keychain status
2026/08/17 10:15:03 [keyring] Keychain status returned nil, keychain exists
2026/08/17 10:15:03 [keyring] Keychain item trusts keyring
2026/08/17 10:15:03 [keyring] Adding service="granted-aws-sso-tokens", label="", account="https://example.awsapps.com/start/", trusted=true to osx keychain "login.keychain"
[✔] [my-profile](eu-west-1) session credentials will expire in 12 hours
2026/08/17 10:15:03 [keyring] Considering backends: [keychain]
2026/08/17 10:15:03 [keyring] Querying keychain for service="granted-aws-sso-tokens", account="https://example.awsapps.com/start/", keychain="login.keychain"
2026/08/17 10:15:03 [keyring] Found item "granted-aws-sso-tokens"
[✔] Exported sso token to ~/.aws/sso/cache

Note the trailing slash difference:

• granted sso login stores under account https://example.awsapps.com/start (no trailing slash)
• assume looks up https://example.awsapps.com/start/ (with trailing slash), gets "No results found", and has to re-authenticate

[MLuc24]

Confirmed from the source — the setting is only ever read in one place, and it isn't the login path. ExportSSOToken is declared in config and consumed exactly once, in pkg/assume/assume.go:

if assumeFlags.Bool("export-sso-token") || cfg.ExportSSOToken {
    err := cfaws.ExportAccessTokenToCache(c.Context, profile)
    ...
    clio.Success("Exported sso token to ~/.aws/sso/cache")
}

Nothing in pkg/granted/sso.go references it, so granted sso login isn't ignoring the flag so much as never asking about it. Your observation is exactly right and it's a gap rather than a misconfiguration.

Worth flagging one thing for whoever picks this up, because it isn't a case of calling the existing helper from one more place. ExportAccessTokenToCache is shaped around a profile:

func ExportAccessTokenToCache(ctx context.Context, profile *Profile) error {
	secureSSOTokenStorage := securestorage.NewSecureSSOTokenStorage()
	// Find the access token for the SSOStartURL and SSOSessionName
	tokenKey := profile.SSOStartURL() + profile.AWSConfig.SSOSessionName
	cachedToken := secureSSOTokenStorage.GetValidSSOToken(ctx, tokenKey)
	ssoPlainTextOut := CreatePlainTextSSO(profile.AWSConfig, cachedToken)
	err := ssoPlainTextOut.DumpToCacheDirectory()

It needs a profile for both the token key and for CreatePlainTextSSO. But LoginCommand takes no profile — its flags are --sso-region, --sso-start-url, --sso-scope and the browser/flow options. So the standalone login has the start URL but no SSOSessionName and no AWSConfig to hand over, which means the fix is either a variant of the helper that takes those pieces directly, or resolving a matching profile from the start URL first.

That distinction is probably worth putting in the issue, since "just call ExportAccessTokenToCache from sso login too" is the obvious suggestion and it won't compile as-is.

In the meantime, assume against any profile using that start URL will populate the cache, since it goes down the branch that does work — not a fix, but it unblocks Terraform and the SSM plugin without a second browser round trip.

[IskanderNovena]

That results in other issues, like mentioned in #969