One read of Claude Documentationclaude-docs-20261029T183705Z
3 pages moved out of 280 read.
Pages moved
3
significant first
Pages read
280
in this capture
Captured
18:37 UTC
Corpus hash
5a6b734f85cc
corpus-hash
What this read moved
1-3 of 3government/desktop/import Changed · +2 / -3 lines
from line 36
3636
3737* **Claude Desktop is up to date.** Update Claude Desktop to 3.1623.0 or later and restart it, or ask your IT administrator to update it.
3838* **You have an account on the web app.** It must use the same work email address as your account in Claude Desktop.
39* **You are signed in to the web app in your default browser.** The import opens a browser tab there and asks for a one-time code, which expires after a few minutes.
4039
4140> **For administrators:** Anthropic enables the import for each organization. If a member's **Import & export** page says import is not enabled and their app is up to date, contact your Anthropic representative. The import needs Claude Desktop to download a component, so on a network that blocks `downloads.claude.ai`, deploy the offline installer described under [Installer and packaging](https://claude.com/docs/government/deploy-desktop/windows-checklist.md#installer-and-packaging) in the Windows fleet checklist.
4241
from line 75
7675
7776**2. Sign in and enter the code**
7877
79Click **Sign in to Claude for Government Web…**, and in the dialog that opens, click **Sign in**. Claude Desktop shows a one-time code and opens the web app in your default browser. Sign in there with your work account if you are asked to, enter the code, and approve the request. Then return to Claude Desktop.
78Click **Sign in to Claude for Government Web…**, and in the dialog that opens, click **Sign in**. Claude Desktop shows a one-time code, which expires after a few minutes, and opens a tab in your default browser. In that tab, enter the code and approve the request. If you are asked to sign in, use your work account. Then return to Claude Desktop.
8079
8180**3. Fetch your export**
8281
from line 110
111110| What you see | Likely cause | What to do |
112111| - | - | - |
113112| Your export exceeds the import size limit | You have more data than the import can bring over | Remove conversations or files you no longer need in the web app, in line with your organization's records policy, then run the import again |
114| The account does not match your organization | You signed in to the web app with a different account or organization | In the browser, sign in to the web app with your work account, then click **Sign in** in the dialog again |
113| The account does not match your organization | You signed in with a different account or organization | If your browser is signed in to the web app with a different account, sign out there. Then click **Sign in** in the dialog again and use your work account in the browser tab |
115114| The **Import & export** page says import isn't enabled for this deployment | Your app is out of date, or Anthropic has not yet enabled the import for your organization | Update Claude Desktop to the latest version. If the page still says import isn't enabled, contact your administrator, who can ask Anthropic to enable it |
116115
117116For anything else, try the import again; if it keeps failing, contact your administrator.
third-party/claude-desktop/data-storage Changed · +26 / -3 lines
### Unreadable saved API keys
from line 29
2929| Path | Contents |
3030| - | - |
3131| `ant-did` | The random device identifier described above. |
32| `configLibrary/` | Locally authored configuration (from the in-app configuration window). `_meta.json` records which saved configuration is applied; each is a `<id>.json` file alongside it. Ignored when a managed profile is present. |
32| `configLibrary/` | Locally authored configuration (from the in-app configuration window). `_meta.json` records which saved configuration is applied; each is a `<id>.json` file alongside it. API keys in these files are encrypted (see [Credentials](#credentials)). Ignored when a managed profile is present. |
3333| `local-agent-mode-sessions/.../cowork_account_settings.json` | User-level preferences set in the app, such as locale, the memory toggle, and the text entered under **Instructions for Claude** and **Global instructions**. |
3434| `local-agent-mode-sessions/` | Cowork and Chat conversation history. One `local_<uuid>.json` file plus a working directory per session, scoped by the `ant-did` device identifier and the organization ID, not by who is signed in to the app. The working directory includes an `uploads/` subdirectory with copies of files attached to the conversation and an `outputs/` subdirectory for files Claude creates. |
3535| `local-agent-mode-sessions/.../memory/` | Cowork memory: a `CLAUDE.md` instructions file plus a `memory/` subdirectory of Markdown notes Claude writes about the user's preferences, projects, and feedback. See [Memory](#memory). |
from line 41
4141| `cowork_plugins/` | User-installed and [org-provisioned](https://claude.com/docs/third-party/claude-desktop/extensions.md#organization-plugins-admin) plugins. Created on first plugin install. |
4242| `IndexedDB/`, `Local Storage/`, `Session Storage/` | Renderer-side UI state (window layout, recent folders, preferences). |
4343
44Files in this directory are written with owner-only permissions so other OS accounts on the same machine cannot read them. The app encrypts stored sign-in tokens and similar secrets with the operating system's secure storage (see [Credentials](#credentials)), but not conversations, settings, or locally applied configuration, including an API key saved from the in-app configuration window. Protection at rest for those files depends on the device's full-disk encryption, such as FileVault or BitLocker.
44Files in this directory are written with owner-only permissions so other OS accounts on the same machine cannot read them. The app encrypts stored sign-in tokens, API keys saved from the in-app configuration window, and similar secrets with the operating system's secure storage (see [Credentials](#credentials)). It doesn't encrypt conversations, settings, or the rest of the locally applied configuration. Protection at rest for those files depends on the device's full-disk encryption, such as FileVault or BitLocker.
4545
4646The logs directory contains `main.log` (application and configuration-validation events), `cowork_vm_node.log` (sandbox VM activity), `claude.ai-web.log` (renderer events), and `mcp.log` / `mcp-server-<name>.log` (MCP connection events).
4747
from line 73
7373Inference credentials are handled according to how they're delivered:
7474
7575* **Managed configuration** (for example, `inferenceGatewayApiKey`, `inferenceBedrockBearerToken`): read from the OS preference store or registry at launch and held in memory. The app also writes resolved credentials to a small set of transient, owner-only files for its own session processes, described below.
76* **API keys saved in the in-app configuration window**: stored in the `configLibrary/` files, encrypted with the operating system's secure storage (Keychain on macOS, DPAPI on Windows, GNOME Keyring or KWallet on Linux). Requires Claude Desktop 4.4212.0 or later, which also encrypts a key that an earlier version saved, the next time the app launches. See [Unreadable saved API keys](#unreadable-saved-api-keys).
7677* **OAuth tokens** (in-app Google sign-in, MCP servers with `oauth: true`): stored in the application-data directory, encrypted with the operating system's secure storage (Keychain on macOS, DPAPI on Windows).
7778* **Credential-helper output**: held in memory for `inferenceCredentialHelperTtlSec` seconds, then discarded and re-fetched.
7879
from line 83
8283
8384| Path (within the application-data directory) | Contents | Lifecycle |
8485| - | - | - |
85| `host-creds-<random-id>.json` | The resolved inference credential (bearer token or API key, plus the endpoint), as environment values for background Claude Code worker processes. Written atomically with owner-only permissions (mode `0600` on macOS; per-user ACLs on Windows). | Rewritten on each credential refresh; deleted when the app quits; leftovers from a crash are removed at the next launch. The random path segment is regenerated when you sign out of the inference provider or its credentials are rotated, so a process holding the old path loses access. |
86| `host-creds-<random-id>.json` | The resolved inference credential (plus the endpoint), as environment values for background Claude Code worker processes. The app writes it for credentials that it renews, such as a sign-in token or credential-helper output. Before Claude Desktop 4.29.0, the app also wrote it for a static API key or bearer token. Written atomically with owner-only permissions (mode `0600` on macOS; per-user ACLs on Windows). | Rewritten on each credential refresh; deleted when the app quits; leftovers from a crash are removed at the next launch. The random path segment is regenerated when you sign out of the inference provider or its credentials are rotated, so a process holding the old path loses access. |
8687| `ccd-session-secrets/<session-id>/` | File-based credentials for Code sessions: Google Cloud application default credentials for Google Cloud's Agent Platform, or AWS configuration files for Amazon Bedrock. The directory is created with owner-only permissions (mode `0700` on macOS; per-user ACLs on Windows). | Created when the session starts; removed when the session ends; the whole directory is swept before the next Code session starts and when you sign out of the inference provider. |
8788| Per-session working directory | For Cowork sessions, the same file-based credentials (Google Cloud's Agent Platform and Amazon Bedrock) are written into the session's working directory. | Scoped to the session; removed with the session directory. |
8889
8990Aside from these files, credentials delivered through managed configuration are held in memory only.
9091
92### Unreadable saved API keys
93
94An encrypted API key can be decrypted only through the secure storage of the OS user account that saved it, so a copy of the `configLibrary/` files alone can't be decrypted elsewhere. Where that account's secure storage moves with the user, for example in a Windows roaming profile that carries the user's DPAPI keys, the key also decrypts on the other device.
95
96When Claude Desktop can't decrypt the key that its connection uses, it shows the banner **Claude can’t read your saved key** and doesn't start sessions. The saved file stays as it is.
97
98Have the user enter the key again in the in-app configuration window, then restart the app, after any of these:
99
100* **The data moves without its secure storage**: the application-data directory is copied or restored to another device or another OS user account
101* **A Windows profile changes**: the profile is rebuilt, roams without the user's DPAPI keys, or belongs to a local account whose password an administrator reset
102* **The macOS login keychain is reset**
103* **The desktop environment changes on Linux**: a key saved under GNOME Keyring can't be decrypted in a KDE session, or the reverse
104* **The app is rolled back**: versions earlier than Claude Desktop 4.29.0 send the encrypted text as the key, and the provider refuses it
105
106These cases call for something else:
107
108* **Windows profiles that don't keep the user's DPAPI keys between sign-ins**: the user has to enter the key at each sign-in, so deliver the key through managed configuration instead
109* **Secure storage that isn't available as the app launches**: a restart alone is enough. For example, this happens on Linux when the app starts at login before the keyring does, and on macOS when the user dismisses the keychain prompt.
110* **Devices with no secure storage that the app can use**, such as Linux without GNOME Keyring or KWallet: the key stays unencrypted, and the configuration window shows **This key is saved unencrypted on this computer.** under the key
111* **Tools that read or write the `configLibrary/` files**: a tool that reads the key gets the encrypted value. A tool that writes an unencrypted key still works, and the app encrypts that key the next time it launches.
112
91113## Automatic deletion of idle sessions
92114
93115By default, chats, Cowork tasks, and Code sessions stay on the device until the user deletes them. To delete them after a period without activity, set [`chatSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#chatsessionretentiondays), [`coworkSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#coworksessionretentiondays), or [`codeSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#codesessionretentiondays) to a number of days from 1 to 3650. Each key covers one kind of session, and a kind you leave unset is kept until the user deletes it. Idle time counts from the session's last activity, and pinned sessions are not exempt.
from line 156
134156Ask the user to:
135157
136158* Sign in to the inference provider, if the app asks
159* Enter the provider API key again, if the user saved it in the in-app configuration window (see [Unreadable saved API keys](#unreadable-saved-api-keys))
137160* Reconnect each connector
138161* Enter the environment variables for Code sessions from their original source, because the app masks saved values
139162* In each project they use from Chat, use **Choose a folder > Choose a different folder** to select the same folders again
government/moving-from-web Changed · +1 / -1 lines
from line 30
3030
3131## The Claude for Government Web import
3232
33* **How do users bring over their conversations and projects?** Each user runs the import themselves from Claude Desktop, which signs in to their web app account. See [Import your data from Claude for Government Web](https://claude.com/docs/government/desktop/import.md).
33* **How do users bring over their conversations and projects?** Each user runs the import themselves from Claude Desktop. See [Import your data from Claude for Government Web](https://claude.com/docs/government/desktop/import.md).
3434* **Can administrators remind users to run the import?** Yes. Turn on the [**Show the Claude for Government Web import banner**](https://claude.com/docs/government/config/settings.md#show-the-claude-for-government-web-import-banner) switch on the **Config** page.
3535* **The Import & export page in Claude Desktop says import isn't enabled.** See [Troubleshooting](https://claude.com/docs/government/desktop/import.md#troubleshooting) on the import page.
3636* **What comes across, and how does a user redo an import?** See [Things to know](https://claude.com/docs/government/desktop/import.md#things-to-know) and [Remove an import](https://claude.com/docs/government/desktop/import.md#remove-an-import).