Keys and credentials

Every credential (API keys, sign-in tokens, bearer tokens for MCP servers) is encrypted with your node's master key (<data>/master.key) and stored with Mandala's records. Keys are never shown again after you save them.

Add or replace

• In the app: open the connection's page in Settings (Models or Extensions), paste the key, Connect. Replace swaps it; Disconnect removes it.
• From the environment file, at each start: ALMA_OPENAI_API_KEY, ALMA_ANTHROPIC_API_KEY, ALMA_GEMINI_API_KEY, ALMA_XAI_API_KEY, ALMA_DEEPSEEK_API_KEY, ALMA_KIMI_API_KEY, ALMA_ZAI_API_KEY, ALMA_META_API_KEY, ALMA_BRAVE_API_KEY, ALMA_WAVESPEED_API_KEY, ALMA_TYPESAFE_API_KEY. A key in the environment overwrites the stored one at every start; remove it from the file once stored if you prefer to manage it in the app.

See what is stored

Settings → Extensions → Stored credentials lists every credential by name, never by value.

Protect the master key

master.key decrypts every credential. Keep it readable only by Mandala's user (chmod 600), back it up with the rest of the data directory, and never copy it anywhere else. Lose it, and you must enter every key again; leak it with a copy of the data, and every key is exposed: rotate them at their providers.

Other secrets on the node

Treat the whole data directory as secret. See The data directory.