docs(proxy): the --pkce refresh token now lives in the OS keychain

[mateo-berri]

The CLI docs still said the --pkce refresh token sits in ~/.litellm/token.json, and told readers to treat that file as sensitive because anyone who can read it can trade the refresh token for a working key. PR #37665 moves the refresh token into the OS keychain next to the key, so that stops being true on any machine with a keychain

The security warning now applies to the case where it still holds, a machine with no usable keychain, where both halves fall back into the 0600 file and lite login says so. The stored-credential section also picks up the upgrade note: a --pkce login made with an earlier lite keeps its refresh token in the file until the next command reads it and moves it. lite logout is described as clearing both stores rather than just deleting the file, which has been true since the key moved into the keychain

Merge alongside BerriAI/litellm#37665

---

Note

Low Risk
Documentation-only wording updates; no code, auth, or storage behavior is changed in this PR.

Overview
Updates CLI docs so --pkce storage matches the keychain change: the refresh token now lives in the OS keychain next to the key, not in ~/.litellm/token.json.

The sensitivity warning is limited to machines with no usable keychain (both secrets fall back into that 0600 file). Docs also note that older --pkce logins keep the refresh token in the file until the next lite command migrates it, and that lite logout clears both the keychain and the token file.

^{Reviewed by Cursor Bugbot for commit f197b2d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview	Aug 20, 2026 7:28pm

[mateo-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f197b2d. Configure here.}