# Your API keys and credential store

> Public channel — documentation of app 3.6.3. Follow the availability notices of each service.

Source: [Your API keys and credential store](/en/application/reglages/cles-et-trousseau/)

VibeStarter keeps two kinds of secrets: the **session token** of your VibeStarter account, created when you sign in, and **your personal API keys**, if you bring some. Both are stored in the credential store of your operating system, not in a file of the app.

## Where your keys are set

In Settings → Keys & generation, which contains three sections:

Roblox API key, Who pays for generations and Personal API keys.

Bringing your own keys is the alternative to the VibeStarter credits subscription. See [AI credits in practice](/en/offres/credits-ia/). The Roblox key, for its part, is used to publish and create your game products. See [Link your Roblox account and your Open Cloud key](/en/application/studio/compte-roblox/).

## Where your secrets live

-   [Windows](/en/application/reglages/cles-et-trousseau/#tab-panel-0-0)
-   [Mac](/en/application/reglages/cles-et-trousseau/#tab-panel-0-1)

In the **Credential Manager** of Windows, under Windows Credentials.

If that fails, the app falls back to a local vault **encrypted by Windows** in its data folder.

In the **macOS keychain**, which you can view with the Keychain Access app.

If that fails, the app falls back to a local vault. **On macOS, this backup file is not encrypted**: it is only protected by its file permissions.

As long as a key lives outside the system store, the app keeps a banner displayed: “Your keys are not in the system credential store.” It disappears when the store is usable again.

## The Windows credential store is full

This is the most common case, and its message is misleading.

“Windows error code 8” is not a lack of memory

This code means the **Windows credential store is full**, not that your computer is short of RAM. Starting VibeStarter as administrator does not change anything.

1.  Open the **Credential Manager** of Windows.
    
2.  Go to Windows Credentials.
    
3.  Delete the entries you no longer need.
    
4.  Go back to VibeStarter and click Retry the credential store.
    

## The macOS keychain

On the first write, macOS asks for permission to access the keychain. \*\*Answering

Deny is not treated as the store being unavailable\*\*: the app shows an error and does not fall back to its backup vault. Try again and allow access.

After an uninstall, the keychain entries remain. Delete them by hand with Keychain Access. See [Uninstall VibeStarter](/en/application/premiers-pas/desinstaller/).

## Limits

-   A “Set” badge next to a key only means a value is stored. **Only the Roblox key is actually tested**, so a wrong key can show the badge and still fail when you use it.
-   Changing a key **does not restart the agents**, and a generation already sent keeps the configuration it had at the start. Wait for the current call to end: the next one will use the new key.
-   On macOS, the backup vault is not encrypted.
-   The session token is tied to this device: it cannot be copied to another machine.

## Frequently asked questions

**Is the “Your keys are not in the system credential store” banner blocking?** No. The app keeps working with its backup vault. The banner stays displayed so you know where your secrets live.

**I changed my key and the generation in progress still uses the old one.** This is expected. The call already sent keeps its starting configuration.

**Why does the app ask me to sign in again at every start?** The session token cannot be stored. Apply the full credential store procedure above, then sign in again. See [Create your account and connect your computer](/en/application/premiers-pas/connexion/).

**Do my API keys go to your servers?** They are stored in your system’s credential store. What the app sends, and to whom, is covered in [Your account and your data](/en/offres/compte-et-donnees/).

**Can an API key replace an AI subscription?** The keys set here are for **asset generations**, not for the agent that writes your code. See [Which AI subscription to choose](/en/application/agents/choisir-son-ia/).

## Going further

-   [AI credits in practice](/en/offres/credits-ia/)
-   [Connect your AI account](/en/application/agents/connecter-ton-ia/)
-   [Where your data is on disk](/en/application/reglages/donnees-sur-le-disque/)
-   [I can’t sign in](/en/aide/connexion/)