Key storage

Your key sits in this browser's local storage, in plain text, under the name app-models - ten seconds in the browser's developer tools shows it. Everything below follows from that fact.

Where your API keys are stored

Read it yourself in Chrome or Edge: F12 on Windows, Cmd + Opt + I on macOS. Then Application > Local Storage, pick the site, and open app-models.

Signing in moves nothing: credentials stay on the device, and a Big-AGI account holds none. Which route a service uses decides whether the Big-AGI server handles one: with Direct Connection on the browser calls the AI service itself, otherwise the server does (Direct Connection).

Local storage is scoped to a browser profile and a site, not to a person: anyone using that profile, and any extension with access to the site, reads what is in it. On a shared or work machine, in order of effort:

1. Use a separate browser profile that only you unlock.
2. For a one-off session, a private window - it keeps nothing after you close it, chats included.
3. Give that machine its own key, scoped to its own project with a low cap.
4. On managed machines, run an instance where the operator supplies keys and users never handle one (keys and access control).

What a stolen key can do

Spend your money at that AI service, up to whatever cap exists there, and nothing else: the key grants no access to your chats, files or Big-AGI account. The service-side cap therefore matters more than any local precaution.

Rotating and revoking

I think my key leaked - three moves, hurried:

1. Revoke it in the service's console. Only the AI service can invalidate a key, and it is the one action that stops the spending.
2. Create a replacement and type it over the field, or clear the field and remove the service.
3. Read the service's usage or activity page for the period the old key was out.

The same three moves, unhurried, are ordinary rotation: create the new key, paste it over the old value, then delete the old key at the service. A key stays valid until the service revokes it, so the last move is the one that counts.

To take a key off a device entirely: clear the field or remove the service; clear the browser's site data, which takes your chats with it; or run the app's own data wipe, which removes app-models first among the stores it clears.

Related

• Add and manage your keys
• Direct Connection
• Back up your work, and restore it
• Keys and access control