From 8a831af8a8ded69b7dfdced63c18d5d9562d6239 Mon Sep 17 00:00:00 2001 From: "marcus.hinz" Date: Sun, 5 Jul 2026 15:41:29 +0200 Subject: [PATCH] =?UTF-8?q?README:=20API-Keys=20liegen=20im=20Keychain;=20?= =?UTF-8?q?ausdr=C3=BCckliche=20Warnung=20vor=20dem=20Datei-Fallback=20im?= =?UTF-8?q?=20Pool-Verzeichnis?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 59bb1bc..c8cce72 100644 --- a/README.md +++ b/README.md @@ -97,6 +97,8 @@ ai-control is pool management only — it does not change, extend, or circumvent For that reason the app stores no OAuth tokens itself: with an OAuth pool, the first session of a project on that pool goes through the regular Anthropic login (`/login`, browser, against your subscription), run by Claude Code itself. Credentials live where Claude Code puts them — in the macOS keychain, one entry per pool. +API keys go into the keychain as well (one entry per pool). Only when no keychain/keyring is available does the app offer — after an explicit confirmation — to store the key as a file in the pool directory (mode 0600). We strongly advise against that fallback: an API key on disk is readable by every process running as your user. Use the keychain. + ## License [MIT](LICENSE)