Context

When clicking the "Open in VS Code Desktop" button in the Coder web UI to connect to a workspace on macOS, users may see a macOS Keychain prompt asking for the login keychain password to access credentials stored under coder-v2-credentials. The prompt includes options: Always Allow, Deny, and Allow.

Answer

This behavior is expected on macOS and is not a cause for concern.

When you open a workspace in VS Code Desktop, the Coder VS Code extension checks for an existing Coder authentication token and may store or update it in the macOS system Keychain via Apple's /usr/bin/security utility. Because macOS sees the request as coming through the security utility, it prompts you to authorize access.

You may see this prompt multiple times during a single connection, as different parts of the login and SSH process access the Keychain separately. Clicking Always Allow will prevent the prompt from appearing repeatedly for future connections.

This behavior was introduced as a security improvement to harden shared credential handling and became the default in Coder VS Code extension v1.16.3. Users on v1.16.2 or earlier will not see this prompt, as Keychain usage was not enabled by default in those versions.