Retrieve a Proxy Password with secret-tool

For an interactive desktop session using Secret Service, store a proxy secret separately from its identifying attributes:

secret-tool store --label='Work web proxy' purpose web-proxy host proxy.example

Supply the secret separately; keep it out of the label and attributes. To retrieve it, use secret-tool lookup purpose web-proxy host proxy.example. That command returns the matching secret on standard output, so pass its output to the intended client's supported credential interface rather than a shared diagnostic transcript.

The lookup needs the appropriate user's D-Bus session and an available Secret Service. The collection may need unlocking. A cron job does not automatically reproduce the desktop's unlocked state, and root's lookup does not select another user's keyring.

Handle storage lookup failure separately from rejected proxy authentication. Silently sending an empty password and retrying hides which operation failed.

Prefer separate client credential fields when supported. If credentials must go in a proxy URL, encode username and password as URI components; shell quoting does not perform URL encoding.

The keyring removes the need for a literal secret in .profile. The retrieved value still exists in memory, and exporting it exposes it to inheriting child processes. Protected storage does not make that runtime environment a secret vault.