marcus.hinz/ai-control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: API-Keys liegen im Keychain; ausdrückliche Warnung vor dem Datei-Fallback im Pool-Verzeichnis

Browse Source
This commit is contained in:
marcus.hinz
2026-07-05 15:41:29 +02:00
parent 0ebdaf0460
commit 8a831af8a8
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -97,6 +97,8 @@ ai-control is pool management only — it does not change, extend, or circumvent
For that reason the app stores no OAuth tokens itself: with an OAuth pool, the first session of a project on that pool goes through the regular Anthropic login (`/login`, browser, against your subscription), run by Claude Code itself. Credentials live where Claude Code puts them — in the macOS keychain, one entry per pool. For that reason the app stores no OAuth tokens itself: with an OAuth pool, the first session of a project on that pool goes through the regular Anthropic login (`/login`, browser, against your subscription), run by Claude Code itself. Credentials live where Claude Code puts them — in the macOS keychain, one entry per pool.
API keys go into the keychain as well (one entry per pool). Only when no keychain/keyring is available does the app offer — after an explicit confirmation — to store the key as a file in the pool directory (mode 0600). We strongly advise against that fallback: an API key on disk is readable by every process running as your user. Use the keychain.
## License ## License
[MIT](LICENSE) [MIT](LICENSE)