Keys and where they are kept
A cloud assistant needs a key: a long secret from OpenAI, Anthropic, Google or an OpenAI-compatible service that lets the app use your account. A key can spend money, so the app treats it with care: it never shows it again, never writes it to the settings file, the logs, the project or the workflow, never sends it to the model, and sends it only to the address it was pasted for. Your own server needs no key, unless it asks for one: then paste it in Key for this server (optional). A key for a compatible service, and the key of your own server, go only to the address they were pasted for.
Where a key can live
| Place | When | What it means |
|---|---|---|
| In memory until the app closes | you pasted it and did not tick anything | it works until you close the app; then paste it again |
| Encrypted in the system keychain | you ticked Remember on this computer | GNOME “Passwords and Keys” or KWallet keeps it encrypted; it works after a restart |
| In the app folder, unencrypted (your choice) | no system keychain is available and you ticked Remember in the app folder | a file only your user can read; do this only on your own computer |
Settings ▸ Privacy ▸ Where keys are kept shows, for each key, where it is now. The toolbar chooser says it too, for example "The OpenAI key works until the app closes. It is not written to disk."
How to paste, remember and forget a key
- Settings ▸ Assistant ▸ the provider ▸ its key field. Paste. The app checks it at once with the provider.
- Tick Remember on this computer to keep it.
- Forget key removes it.
- Settings ▸ Privacy ▸ Forget all keys and tokens removes every model key, every server access token and every browser sign-in, from memory, the system keychain and the app folder, after a question.
A key belongs to one address
"A key works only with the address it was pasted for: for another address, paste its own key." If you change Server address (optional), the old key is not sent there.
When the system keychain is missing
"The system keychain is not available on this computer, so keys live only until the app closes." Install or unlock GNOME “Passwords and Keys” or KWallet, or pick it in Settings ▸ Privacy ▸ System keychain and restart the app. The app also refuses a store it cannot prove encrypts: "The app could not confirm that the keychain encrypts keys, so the key was not saved. Keys work only until the app closes; you can pick a keychain in Settings ▸ Privacy."