Credential Storage Security
How the application handles and stores your sensitive Roblox API keys and Bridge Secrets.
When you enter your Roblox Open Cloud API key or your Bridge Secret into the Configuration panel, the application needs a secure way to save these so you don't have to re-enter them every time you launch the app.
This page explains how that storage works and the security implications involved.
1. What is Stored as a Secret?
The application treats exactly two pieces of data as highly sensitive credentials:
- The Roblox Open Cloud API Key: Provides write access to your Creator account.
- The Bridge Secret: Authenticates synchronization payloads to your live game server.
Non-sensitive configuration data (such as your Creator ID, Creator Type, and delay settings) are intentionally not treated as secrets. They are always stored in a plaintext settings.json file in your working directory.
2. Primary Storage: The OS Keychain
By default, the application uses the Python keyring library to store your secrets.
Instead of writing the secrets to a file on your hard drive, the app hands them off to your operating system's native, encrypted credential vault:
- On Windows, it uses the Windows Credential Manager.
- On macOS, it uses the Keychain.
This is the most secure method, as the secrets are encrypted at rest by the OS and are only accessible by your logged-in user account.
3. The Plaintext Fallback
In some environments, an OS-level keychain is not available or not accessible. This commonly happens in headless server environments, Docker containers, or minimal Linux installations.
If the app detects that the native keyring is unavailable or failing, it will automatically fall back to saving your secrets alongside your non-sensitive data in the settings.json file.
The Plaintext Risk: If the application falls back to this method, your API key and Bridge Secret will be saved unencrypted in plaintext on your hard drive. Anyone with file system access to your machine (or access to your version control, if you accidentally commit the file) will be able to read your API key.
How to Tell if Keyring is Working
Verifying Secure Storage: To ensure your secrets are safely in the OS keychain and not the fallback file, enter your API key, close the app entirely, and restart it. If your API key is still present in the Configuration panel, your keyring backend is working correctly. You can double-check by opening settings.json in a text editor to ensure the key is not visible there.
4. Considerations for Distributable Builds
If you decide to package the application into a standalone executable (using tools like PyInstaller or Nuitka), you must pay special attention to credential storage.
Bundling tools often fail to correctly include the native OS backend binaries required by the keyring library. When a user runs your packaged .exe on a fresh machine without Python installed, the keyring library will silently fail and immediately drop down to the plaintext settings.json fallback.
Always test your distributed builds on a clean Virtual Machine. Follow the instructions in the Building a Distributable guide to verify that credential persistence behaves correctly before sharing your build with others.