The Paubox CLI stores credentials in the OS keychain by default. On Linux, this requires the Secret Service API, which is provided by GNOME Keyring or KWallet. The underlying keytar library needs libsecret-1-dev at install time.On Debian/Ubuntu:
Fallback behavior: If libsecret is not available, credentials are stored in ~/.config/paubox/config.json with 0600 permissions (readable only by your user). The CLI will warn you when it falls back to file-based storage.
If you share a machine or use file-based credential storage, ensure ~/.config/paubox/config.json is excluded from any backups or source control.