Auth tokens are stored in the OS keychain (macOS Keychain, Linux Secret Service, Windows Credential Manager) with an encrypted file fallback for environments where a keychain is unavailable.