err will already contain `"xyz" is not a valid environment tag`, so annotating it like this is not really helpful.
How about adding at the top:

```go
defer errors.Contextf(&err, "failed to cache API credentials")
```

Use a named return value for err and just return err in both cases (for invalid user/environ tag).