Your API keys and credential store
VibeStarter keeps two kinds of secrets: the session token of your VibeStarter account, created when you sign in, and your personal API keys, if you bring some. Both are stored in the credential store of your operating system, not in a file of the app.
Where your keys are set
Section titled “Where your keys are set”In Settings → Keys & generation, which contains three sections:
Roblox API key, Who pays for generations and Personal API keys.
Bringing your own keys is the alternative to the VibeStarter credits subscription. See AI credits in practice. The Roblox key, for its part, is used to publish and create your game products. See Link your Roblox account and your Open Cloud key.
Where your secrets live
Section titled “Where your secrets live”In the Credential Manager of Windows, under Windows Credentials.
If that fails, the app falls back to a local vault encrypted by Windows in its data folder.
In the macOS keychain, which you can view with the Keychain Access app.
If that fails, the app falls back to a local vault. On macOS, this backup file is not encrypted: it is only protected by its file permissions.
As long as a key lives outside the system store, the app keeps a banner displayed: “Your keys are not in the system credential store.” It disappears when the store is usable again.
The Windows credential store is full
Section titled “The Windows credential store is full”This is the most common case, and its message is misleading.
-
Open the Credential Manager of Windows.
-
Go to Windows Credentials.
-
Delete the entries you no longer need.
-
Go back to VibeStarter and click Retry the credential store.
The macOS keychain
Section titled “The macOS keychain”On the first write, macOS asks for permission to access the keychain. **Answering
Deny is not treated as the store being unavailable**: the app shows an error and does not fall back to its backup vault. Try again and allow access.
After an uninstall, the keychain entries remain. Delete them by hand with Keychain Access. See Uninstall VibeStarter.
Limits
Section titled “Limits”- A “Set” badge next to a key only means a value is stored. Only the Roblox key is actually tested, so a wrong key can show the badge and still fail when you use it.
- Changing a key does not restart the agents, and a generation already sent keeps the configuration it had at the start. Wait for the current call to end: the next one will use the new key.
- On macOS, the backup vault is not encrypted.
- The session token is tied to this device: it cannot be copied to another machine.
Frequently asked questions
Section titled “Frequently asked questions”Is the “Your keys are not in the system credential store” banner blocking? No. The app keeps working with its backup vault. The banner stays displayed so you know where your secrets live.
I changed my key and the generation in progress still uses the old one. This is expected. The call already sent keeps its starting configuration.
Why does the app ask me to sign in again at every start? The session token cannot be stored. Apply the full credential store procedure above, then sign in again. See Create your account and connect your computer.
Do my API keys go to your servers? They are stored in your system’s credential store. What the app sends, and to whom, is covered in Your account and your data.
Can an API key replace an AI subscription? The keys set here are for asset generations, not for the agent that writes your code. See Which AI subscription to choose.