Token Caching

Tokens are stored in the operating system keyring, not in config.toml.

Platform	Store
macOS	Keychain
Windows	Credential Manager
Linux	Secret Service-compatible keyring

Access tokens are refreshed automatically when the stored token is expired or close to expiry and a refresh token is available.

Use auth refresh when you need to pick up newly consented scopes without a browser prompt:

teams auth refresh
teams auth refresh --scopes "User.Read People.Read Files.Read.All offline_access"

Scope selection for an explicit refresh is intentionally non-destructive:

• --scopes or TEAMS_CLI_SCOPES wins when supplied.
• Otherwise, a scopes value on the selected profile is requested.
• If neither is configured, auth refresh reuses the stored token's granted scopes instead of falling back to the built-in defaults and potentially narrowing the session.

The CLI adds offline_access to delegated scope overrides automatically.

If refresh fails because the token is too old, revoked, or was created without offline_access, sign in again with teams auth login --device-code.

Use teams auth logout or teams auth logout --all to remove stored credentials.

TEAMS_CLI_ACCESS_TOKEN bypasses the keyring for one process and cannot be refreshed by the CLI. It must contain a Microsoft Graph access token. Captured Teams client tokens, including fossteams/teams-token JWT files, are not compatible with Graph commands.