Settings, keys and the Keychain

• AVAILABLEKeys in the macOS KeychainStored, used at call time, never shown again.
• AVAILABLEThe cap at launchPast your cap, nothing starts without your click.
• PARTIALThe cut in flightPassed to Claude cards only, and not yet tested by a real call that reaches the cap.

#Keys

Settings › API keys: keys you bring for data sources go to the macOS Keychain and are never shown again. Removing a key erases it from the Keychain; no other copy exists. The Terminal does the same, and never prints a value.

deskworth secrets list
deskworth secrets set fred
deskworth secrets forget fred

• A key is never written to a database, a file, a persisted variable or a log; a guard keeps that true. The value is erased from memory after use.
• A key goes to its own provider, in a header, at call time, that is what it is for.
• No error copies the address of an external source, and a key found in a provenance address is removed or refused at export.
• By default, quantities and fees from your journal leave as relative values, shares, basis points; symbols, dates and public prices always leave as they are. The setting is kept across restarts.

#Spending limits

Settings › Spending limits holds four settings: start desks without asking, which is on by default; the cap per card; the cap per sub-agent; and a warning threshold. The defaults are 2 dollars per card, 0.50 per sub-agent and 20 per desk.

LimitAt launch the cap is real: past it, nothing starts without your click. Below it, a desk starts without a click, because automatic mode is the default. In flight, each Claude card receives its cap as a spending limit, passed, and not yet tested by a real call that reaches it. Codex, Gemini and the local model have no cut in flight.