Access
Auth
Swarm keeps provider credentials with the swarmd runtime that uses them. Open /auth in Desktop or the terminal UI to connect or manage a provider.
Offered providers
Storage location
Credentials stay on the machine running Swarm.
Desktop and the terminal UI send credentials to the local swarmd runtime. They are not saved in your project, workspace, or swarm.conf. If you connect to Swarm on another computer or server, the credentials are stored on that host, not on the browser or device used to reach it.
Linux default/var/lib/swarmd/swarmd-secrets.pebblecustom data directory<data-dir>/swarmd-secrets.pebble when the daemon is started with an explicit --data-dir.scopeEach saved credential belongs to an account scope, and Swarm separately records which credential is active for each provider.Credential protection
Credential contents are encrypted before they reach disk.
encrypted recordsAPI keys and OAuth tokens are sealed with XChaCha20-Poly1305 before Swarm writes them to the secret Pebble store.local keyDefault encryption uses a local wrapping key beside the secret store at <secret-store>.key. Swarm requires that key to be a regular, service-user-owned file with mode 0600.private directorySwarm creates and enforces mode 0700 on the Pebble store directory.Keep the secret store and its key together when backing up or moving an installation. Do not copy either file into a project, repository, or shared folder.
Coming after launch
More ways to protect and access your credentials.
Vault password protection is planned for after the initial release. Passkey support for Desktop and mobile is also planned for a future release.