Skip to main content
Synti stores every secret — provider API keys, OAuth tokens, source credentials — in a single encrypted file on your machine. Nothing sensitive is written to the plain-text config file, and secrets are only sent to the services you explicitly connect. This page explains the storage model so you can trust it, audit it, and reset it when needed.

​
Where credentials live

The file is created with owner-only permissions. You can verify that no other user can read it:

​
How encryption works

Secrets are sealed with AES-256-GCM. The encryption key is derived with PBKDF2 from a machine-specific seed, so the key never has to be typed and never leaves the device.
This gives protection comparable to an OS keychain, but without interactive unlock prompts — the agent can start and reach its providers unattended, which is what makes the headless server and automations practical.
Because the key is bound to the machine, credentials.enc cannot be decrypted if copied to another computer. When you move to a new machine, re-enter your keys rather than copying the file.
Do not copy credentials.enc between machines and expect it to work. Treat it as device-local. To migrate, reconnect each provider and source on the new machine.

​
What gets stored

The store holds several kinds of secrets, each scoped so that one credential can’t leak into an unrelated context: Credentials are added automatically the first time you complete setup, connect a source, or authenticate an MCP server — you don’t manage the file directly during normal use.

​
Overriding with environment variables

For automation, CI, or the headless server, you can supply a provider key through the environment instead of the encrypted store. Environment values take precedence over anything on disk.
The full lookup order and every supported variable are listed in Environment Variables.

​
Inspecting and resetting

The in-app /debug command lists the credential identifiers that are present — the keys, never the secret values. Use it to confirm a provider or source actually has a stored credential.
Delete or re-authenticate the connection or source it belongs to. Removing a connection clears its scoped secret.
Quit Synti and delete the encrypted file:
On next launch Synti starts with no stored secrets and will prompt you to reconnect. Your workspaces and preferences in config.json are unaffected.

LLM Connections

Connections whose keys land in the credential store.

Environment Variables

Supply keys at launch, ahead of the encrypted store.

Config File

The non-secret settings that sit next to your credentials.

API Providers

Point a connection at a custom endpoint.