diff --git a/.changeset/oauth-keychain-storage.md b/.changeset/oauth-keychain-storage.md
new file mode 100644
index 0000000..4dd5155
--- /dev/null
+++ b/.changeset/oauth-keychain-storage.md
@@ -0,0 +1,5 @@
+---
+"@alchemy/cli": minor
+---
+
+Migrate authentication to standard OAuth 2.0 (PKCE + state validation) and store credentials securely in the OS keychain (macOS Keychain, Linux Secret Service, Windows Credential Manager) via cross-keychain instead of plaintext config. The displayed login URL is now usable for manual paste, and auth completes immediately whether you press Enter or paste the URL in a browser.