User identity and local data changedthird-party/claude-desktop/data-storage
Nearest release: v2.1.318, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 3 Nov 2026 22:29 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 3 Nov 2026 22:37 UTC.
Upstream edited
Recorded here
Lines+6added
Lines−4removed
From line
101
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits35to this page, all time
The whole hunk
from line 101, old and new numbered
/
from line 101
101101Inference credentials are handled according to how they're delivered:
102102
103103* **Managed configuration** (for example, `inferenceGatewayApiKey`, `inferenceBedrockBearerToken`): read from the OS preference store or registry at launch and held in memory. The app also writes resolved credentials to a small set of transient, owner-only files for its own session processes, described below.
104* **API keys saved in the in-app configuration window**: stored in the `configLibrary/` files, encrypted with the operating system's secure storage (Keychain on macOS, DPAPI on Windows, GNOME Keyring or KWallet on Linux). Requires Claude Desktop 4.4212.0 or later, which also encrypts a key that an earlier version saved, the next time the app launches. See [Unreadable saved API keys](#unreadable-saved-api-keys).
104* **API keys saved in the in-app configuration window**: stored in the `configLibrary/` files, encrypted with the operating system's secure storage (Keychain on macOS, DPAPI on Windows, GNOME Keyring or KWallet on Linux). Requires Claude Desktop 4.4212.0 or later, which also encrypts a key that an earlier version saved, at the next launch where secure storage is available. See [Unreadable saved API keys](#unreadable-saved-api-keys).
105105* **OAuth tokens** (in-app Google sign-in, MCP servers with `oauth: true`): stored in the application-data directory, encrypted with the operating system's secure storage (Keychain on macOS, DPAPI on Windows).
106106* **Credential-helper output**: held in memory for `inferenceCredentialHelperTtlSec` seconds, then discarded and re-fetched.
107107
from line 121
121121
122122An encrypted API key can be decrypted only through the secure storage of the OS user account that saved it, so a copy of the `configLibrary/` files alone can't be decrypted elsewhere. Where that account's secure storage moves with the user, for example in a Windows roaming profile that carries the user's DPAPI keys, the key also decrypts on the other device.
123123
124When Claude Desktop can't decrypt the key that its connection uses, it shows the banner **Claude can’t read your saved key** and doesn't start sessions. The saved file stays as it is.
124When Claude Desktop can't decrypt the key that its connection uses, it shows the banner **Claude can’t read your saved key** and doesn't start sessions. Connectors set in the same saved configuration aren't listed or started until the app can decrypt the key. The saved file stays as it is.
125125
126126Have the user enter the key again in the in-app configuration window, then restart the app, after any of these:
127127
from line 134
134134These cases call for something else:
135135
136136* **Windows profiles that don't keep the user's DPAPI keys between sign-ins**: the user has to enter the key at each sign-in, so deliver the key through managed configuration instead
137* **Secure storage that isn't available as the app launches**: a restart alone is enough. For example, this happens on Linux when the app starts at login before the keyring does, and on macOS when the user dismisses the keychain prompt.
137* **Secure storage that isn't available as the app launches**: have the user restart the app once secure storage is available. They don't need to enter the key again. For example, on Linux the app can start at login before the keyring does.
138* **A macOS keychain that the app can't access as it launches**: this happens, for example, when the user dismisses the keychain prompt. Have the user restart the app, and enter their password or click **Allow** if macOS asks. If the banner stays, have the user enter the key again.
139* **A key entered again while secure storage isn't available**: the app saves the key unencrypted and uses it after a restart. At the next launch where secure storage is available, the app encrypts the key, so a later launch without secure storage shows the banner again.
138140* **Devices with no secure storage that the app can use**, such as Linux without GNOME Keyring or KWallet: the key stays unencrypted, and the configuration window shows **This key is saved unencrypted on this computer.** under the key
139* **Tools that read or write the `configLibrary/` files**: a tool that reads the key gets the encrypted value. A tool that writes an unencrypted key still works, and the app encrypts that key the next time it launches.
141* **Tools that read or write the `configLibrary/` files**: a tool that reads the key gets the encrypted value. A tool that writes an unencrypted key still works, and the app encrypts that key at the next launch where secure storage is available.
140142
141143## Automatic deletion of idle sessions
142144
No line in this hunk matches that.