Goose + Github Copilot in WSL: OAuth authentication failed for GITHUB_COPILOT_TOKEN

[ragasits]

I'm trying to configure my new Enterprise-level Github Copilot access, but unfortunately I keep getting an OAuth error.

My environment:

• Windows 11 Enterprise + WSL (Ubuntu)
• Goose install: goose-x86_64-unknown-linux-gnu.tar.bz2
• Goose version: 1.20.1

Configure Github copilot

rgt@DEST-CL-225:/mnt/c/0.job/dev$ goose configure

This will update your existing config files
if you prefer, you can edit them directly at /home/rgt/.config/goose

┌ goose-configure
│
◇ What would you like to configure?
│ Configure Providers
│
◇ Which model provider should we use?
│ GitHub Copilot
│
● Configuring GITHUB_COPILOT_TOKEN using OAuth device code flow...
│
Please visit https://github.com/login/device and enter code AAAA-BBBB
■ Failed to authenticate: Execution error: Failed to save token: Failed to access keyring: Platform secure storage failure: DBus error: The name org.freedesktop.secrets was not provided by any .service files
│
Error: OAuth authentication failed for GITHUB_COPILOT_TOKEN: Execution error: Failed to save token: Failed to access keyring: Platform secure storage failure: DBus error: The name org.freedesktop.secrets was not provided by any .service files
rgt@DEST-CL-225:/mnt/c/0.job/dev$

In Browser:

I successfully added the generated code in the browser before receiving the "OAuth authentication" error:

Congratulations, you're all set!
Your device is now connected.

[elraro]

https://block.github.io/goose/docs/troubleshooting/known-issues#keychainkeyring-errors

[ragasits]

Hi, I tried your suggestion, but now I'm getting a different error message:

rgt@DEST-CL-225:/mnt/c/...$ export GOOSE_DISABLE_KEYRING=1
rgt@DEST-CL-225:/mnt/c/...$ goose configure

This will update your existing config files
if you prefer, you can edit them directly at /home/rgt/.config/goose

┌ goose-configure
│
◇ What would you like to configure?
│ Configure Providers
│
◇ Which model provider should we use?
│ GitHub Copilot
│
● Configuring GITHUB_COPILOT_TOKEN using OAuth device code flow...
│
Please visit https://github.com/login/device and enter code ED63-C3CC
◆ OAuth authentication completed successfully!
│
◇ Model fetch complete
│
└ Execution error: failed to get api info after 3 attempts

thx

[sheikhlimon]

Failed to authenticate: Execution error: Failed to save token: Failed to access keyring: Platform secure storage failure: DBus error: The name org.freedesktop.secrets was not provided by any .service files

This should have been fixed on 1.21.0 and onwards

rgt@DEST-CL-225:/mnt/c/...$ export GOOSE_DISABLE_KEYRING=1

Can you update to latest version and try without this now please

[Dumbris]

WSL OAuth is rough because the browser redirect can't reach back in. a proxy running outside WSL that handles auth and exposes a single endpoint to Goose inside WSL avoids this entirely https://github.com/smart-mcp-proxy/mcpproxy-go

[sheikhlimon]

WSL OAuth is rough because the browser redirect can't reach back in. a proxy running outside WSL that handles auth and exposes a single endpoint to Goose inside WSL avoids this entirely https://github.com/smart-mcp-proxy/mcpproxy-go

Thanks for sharing this. That proxy approach makes sense for tools that rely on browser redirects.

That said, I might be misunderstanding, but in this specific case with GitHub Copilot, I don’t think the failure is happening at the redirect or callback stage. Copilot uses the OAuth device code flow, so there’s no local redirect involved. The browser auth completes successfully (it reports "OAuth authentication completed successfully!"), but then the subsequent API call to api.github.com fails from inside WSL.

That’s why I’m leaning toward this being a networking issue between WSL and GitHub’s API rather than an OAuth redirect problem, though I could absolutely be missing something here, so happy to be corrected if you’ve seen different behavior.

[ragasits]

Hi, I tried with the latest version but I've the same result:

rgt@DEST-CL-225:/mnt/c/...$ goose --version
1.23.1
rgt@DEST-CL-225:/mnt/c/...$ goose configure

This will update your existing config files
if you prefer, you can edit them directly at /home/rgt/.config/goose

┌ goose-configure
│
◇ What would you like to configure?
│ Configure Providers
│
◇ Which model provider should we use?
│ GitHub Copilot
│
● GITHUB_COPILOT_TOKEN is already configured
│
◇ Would you like to update this value?
│ Yes
│
● Configuring GITHUB_COPILOT_TOKEN using OAuth device code flow...
│
Please visit https://github.com/login/device and enter code XXXX-YYYY
■ Failed to authenticate: Execution error: Failed to save token: Secret stored using file-based fallback
│
Error: OAuth authentication failed for GITHUB_COPILOT_TOKEN: Execution error: Failed to save token: Secret stored using file-based fallback

Browser result (from Windows host):

Congratulations, you're all set!
Your device is now connected.

[sheikhlimon]

Thank you 🙏🏻. I think I understand what's wrong. I'll try to fix it soon.

[ragasits]

Hi, I was very happy to see this fix in version 1.24.0. Unfortunately, the fix does not work for me:

`rgt@DEST-CL-225:/mnt/c/0.job/dev/...$ goose --version
1.24.0
rgt@DEST-CL-225:/mnt/c/0.job/dev/...$ goose configure

This will update your existing config files
if you prefer, you can edit them directly at /home/rgt/.config/goose

┌ goose-configure
│
◇ What would you like to configure?
│ Configure Providers
│
◇ Which model provider should we use?
│ GitHub Copilot
│
● GITHUB_COPILOT_TOKEN is already configured
│
◇ Would you like to update this value?
│ Yes
│
● Configuring GITHUB_COPILOT_TOKEN using OAuth device code flow...
│
Please visit https://github.com/login/device and enter code 6666-5555
■ Failed to authenticate: Execution error: Failed to save token: Secret stored using file-based fallback
│
Error: OAuth authentication failed for GITHUB_COPILOT_TOKEN: Execution error: Failed to save token: Secret stored using file-based fallback
rgt@DEST-CL-225:/mnt/c/0.job/dev/...$`

Browser result (from Windows host):

`
Congratulations, you're all set!

Your device is now connected.
`

Thx,

[sheikhlimon]

That's odd - the fix should work.
Also, can you verify if goose actually works despite showing the error? The token might be correctly saved to ~/.config/goose/secrets.yaml even though the error is displayed.

cc @DOsinga

[ragasits]

rgt@DEST-CL-225:/mnt/c/0.job/dev/...$ goose --version
1.25.0

rgt@DEST-CL-225:/mnt/c/0.job/dev/...$ cat ~/.config/goose/secrets.yaml
GITHUB_COPILOT_TOKEN: ghu_NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN

When I start goose after the unsuccessful configuration:

rgt@DEST-CL-225:/mnt/c/0.job/dev/...$ goose

● new session · openai gpt-5.1-codex
20260218_1 · /mnt/c/0.job/dev/...

🪿 goose ready — type a message to get started

Use the last successfully configured model.

This i my config:

rgt@DEST-CL-225:~/.config/goose$ cat config.yaml
OPENAI_HOST: https://api.openai.com
OPENAI_BASE_PATH: v1/chat/completions
GOOSE_PROVIDER: openai
GOOSE_MODEL: gpt-5.1-codex
GOOSE_MODE: auto
extensions:
autovisualiser:
enabled: true
type: builtin
name: autovisualiser
description: Data visualisation and UI generation tools
display_name: Auto Visualiser
timeout: 300
bundled: true
available_tools: []
todo:
enabled: true
type: platform
name: todo
description: Enable a todo list for goose so it can keep track of what it is doing
display_name: Todo
bundled: true
available_tools: []
chatrecall:
enabled: false
type: platform
name: chatrecall
description: Search past conversations and load session summaries for contextual memory
display_name: Chat Recall
bundled: true
available_tools: []
extensionmanager:
enabled: false
type: platform
name: Extension Manager
description: Enable extension management tools for discovering, enabling, and disabling extensions
display_name: Extension Manager
bundled: true
available_tools: []
computercontroller:
enabled: false
type: builtin
name: computercontroller
description: controls for webscraping, file caching, and automations
display_name: Computer Controller
timeout: 300
bundled: true
available_tools: []
developer:
enabled: true
type: builtin
name: developer
description: Code editing and shell access
display_name: Developer Tools
timeout: 300
bundled: true
available_tools: []
skills:
enabled: true
type: platform
name: skills
description: Load and use skills from relevant directories
display_name: Skills
bundled: true
available_tools: []
code_execution:
enabled: false
type: platform
name: code_execution
description: Goose will make extension calls through code execution, saving tokens
display_name: Code Mode
bundled: true
available_tools: []
apps:
enabled: true
type: platform
name: apps
description: Create and manage custom Goose apps through chat. Apps are HTML/CSS/JavaScript and run in sandboxed windows.
display_name: Apps
bundled: true
available_tools: []
tom:
enabled: false
type: platform
name: tom
description: Inject custom context into every turn via GOOSE_MOIM_MESSAGE_TEXT and GOOSE_MOIM_MESSAGE_FILE environment variables
display_name: Top Of Mind
bundled: true
available_tools: []
summon:
enabled: true
type: platform
name: summon
description: Load knowledge and delegate tasks to subagents
display_name: Summon
bundled: true
available_tools: []
GOOSE_TELEMETRY_ENABLED: false

[sheikhlimon]

the error is being returned when it shouldn't be. Even though the token was saved successfully, the configure flow sees an error and aborts, leaving the original openai config in place.