Repeating macOS Keychain prompt: IDE asks for login password when reading stored GitHub token

Problem

On macOS, a native Keychain dialog opens repeatedly while an IntelliJ-based IDE is running:

IntelliJ IDEA wants to use your confidential information stored in "IntelliJ Platform GitHub — <id>" in your keychain. To allow this, enter the "login" keychain password.

The dialog returns within a minute or two of being dismissed, often as a burst of several prompts within a few seconds. The IDE log records entries such as:

WARN - #c.i.c.PasswordSafeSettings - find: User canceled the operation. (-128)
WARN - #c.i.c.PasswordSafeSettings - User denied access to CredentialAttributes(serviceName=IntelliJ Platform GitHub — <id>, ..., cacheDeniedItems=true)
WARN - #o.j.p.g.a.a.GHAccountManager - Could not retrieve credentials for account github.com/<name>

The prompt names the item IntelliJ Platform GitHub — <uuid> and the keychain login. It occurs on IntelliJ IDEA, PyCharm, WebStorm, and other IntelliJ-based IDEs that store credentials in the macOS native Keychain.

Cause

The Keychain item was created by an earlier IntelliJ-based IDE build, for example a stable IntelliJ IDEA or an older EAP build. Each macOS Keychain item has an access-control list of applications that may read it without entering the keychain password.

After an IDE update the application bundle is re-signed, and macOS treats the new build as a different application. The new build is not on the item's access list, so Keychain asks for the login keychain password before releasing the stored credential.

The prompt repeats because the IDE caches a denied Keychain result for one minute only. When the next operation that needs the credential runs, the IDE calls Keychain again and a new prompt appears. Several reads that start at the same time can each open their own dialog, which produces the observed bursts.

Credential reads can be triggered by:

• A GitHub session expiring and the IDE reading the stored OAuth token to refresh it.
• A background check for incoming Git changes on a project that uses a GitHub remote.
• Opening a dialog that references a stored credential.

Related issues: IDE loses access to macOS keychain after update, Detect failed access to keychain by Github plugin, Repeating request for github secrets.

Resolution

Three options, from least disruptive to most disruptive.

Option 1: Grant the current IDE build access to the Keychain item

1. When the Keychain dialog appears, enter the macOS user account password.
2. Click Always Allow.

Option 2: Remove the stored credential and let the current build create it

1. In the IDE, open Settings (on macOS: IntelliJ IDEA | Settings) and go to Version Control | GitHub.
2. Select each configured GitHub account and remove it.
3. Open Keychain Access on macOS.
4. Search for IntelliJ Platform GitHub and delete every matching item.
5. Return to Settings | Version Control | GitHub and sign in again.

Option 3: Switch IDE password storage to the embedded KeePass store

The IDE stores credentials in its own file instead of the macOS Keychain, so changes to the application signature do not affect access.

1. In the IDE, open the Passwords settings page (Settings | Appearance & Behavior | System Settings | Passwords).
2. Select In KeePass.