Passwords and keys
Claudette keeps the secrets you give it, Perforce passwords and API keys, in your operating system’s credential store and nowhere else. They’re not in settings, in state, in logs, in an environment variable or on a command line, and they’re never synced.
Claude Code’s own sign-in is Claude Code’s. Claudette never reads or stores it.
The credential store
- Windows: Credential Manager, kept for your user on this machine and not roamed to others.
- macOS: the Keychain.
- Linux: the Secret Service, through
secret-tool. Withoutsecret-tool(thelibsecret-toolspackage), Settings says to install it. Perforce passwords can then only be asked for each time, and API keys can’t be added. See Something missing on Linux.
Each machine has its own store, so a secret you saved on one machine isn’t on another. Settings sync and the session library never carry them.
Perforce passwords
Settings → Perforce → Password source chooses where the password comes from:
- Stored by Claudette (recommended) keeps it in the credential store, under the server and user. The first time a tab needs to log in, it asks and offers to save the password once the login has worked. Settings → Perforce → Stored password can also Save password or Forget password for a server and user.
- Perforce’s own configuration (P4PASSWD) reads
P4PASSWDfrom your Perforce configuration. Those places keep a password as plain text, and Settings warns about it. Claudette only reads it. - Ask each time shows a password prompt when a login is needed and stores nothing.
When Claudette logs in for you, it gives the password to p4 login on its standard input, so it never appears on a command line, where other programs could see it. Claude never sees it. See Perforce.
API keys
A key you add in Settings → Accounts → Add an API key goes to the credential store as soon as you save it. Claudette’s files keep only the account’s name and color. Without a credential store, such as Linux without secret-tool, adding a key is off, and says why.
Claude Code gets the key when it asks for it, through a small command that Claudette itself runs: it prints the key from the credential store for the claude that asked, then exits. The key isn’t in an environment variable, on a command line or in a file. Change key… replaces it, and Remove… on an account deletes the key from the store. See API-key accounts.
In the logs
Claudette’s own log, claudette.log, holds its warnings and errors. The optional protocol log (Settings → Advanced → Log protocol traffic) takes sign-in codes and values under the usual names for tokens, keys and passwords out of each line, but it holds your prompts and file contents, so treat it as private and don’t post it as it is. It’s deleted after 7 days.