cco: OAuth refresh fix
β’ 220 words β’ 2 min
Problem statement: cco is not able to autonomously refresh the OAuth token
used by claude.
The manual workaround is to run an one-off unsandboxed claude, and then get
back to cco afterwards.
Why?
Run /doctor within cco and compare its output with /doctor within an
unsandbox claude code session. The culprit:
Warning: macOS Keychain is not writable (security: SecKeychainItemCreateFromContent (<default>): UNIX[Operation not permitted];
add-generic-password: returned 100001). Console login will fail to save your API key.
Fix: Run: security unlock-keychain ~/Library/Keychains/login.keychain-db β if that doesn't fix it, your login keychain password may
be out of sync with your account password: open Keychain Access, select the 'login' keychain, then Edit β Change Password for
Keychain 'login'.So now I am passing --add-dir ~/Library/Keychains to cco, and the warning is
finally gone!
diff
commit 5c111a7caffb4e6b3dc4d678d4fc1bd6c8296ae5
Author: Thiago Perrotta <{redacted}>
Date: Sun Apr 12 07:34:53 2026 +0200
cco: add key chain dir, via /doctor
diff --git profile/.profile.d/alias.sh profile/.profile.d/alias.sh
index 0f5018c..80d7b60 100644
--- profile/.profile.d/alias.sh
+++ profile/.profile.d/alias.sh
@@ -51,7 +51,7 @@ fi
if command -v claude >/dev/null 2>&1; then
if command -v cco >/dev/null 2>&1; then
- alias claudey="cco --allow-oauth-refresh --add-dir ~/.cache --add-dir ~/.aws/cli/cache --add-dir ~/.aws/sso/cache --add-dir ~/.azure --add-dir ~/.terraform.d/plugin-cache --add-dir ~/go"
+ alias claudey="cco --allow-oauth-refresh --add-dir ~/.cache --add-dir ~/.aws/cli/cache --add-dir ~/.aws/sso/cache --add-dir ~/.azure --add-dir ~/.terraform.d/plugin-cache --add-dir ~/go --add-dir ~/Library/Keychains"
fi
alias claudeyy="claude --allow-dangerously-skip-permissions"
fi