Credential handling
Bom Agent stores CLI tokens, OAuth sessions, and third-party credentials securely on your local machine.
Where credentials live
- CLI tokens — each CLI's standard location (~/.claude/, ~/.codex/)
- OAuth sessions — AuthSessionService memory + OS secure store
- Notion credentials — NotionCredentials object (transmitted only to Bom.Server)
- Browser cookies — Playwright user data dir (~/.bom/browser-profiles/)
OS stores
macOS Keychain on Mac, DPAPI on Windows.
How to remove
- A specific CLI — Settings → CLI priority → disconnect that CLI
- OAuth session — Profile → Sign out
- Everything — Settings → Account → "Delete all data"
Credentials and Packs
Pack definitions never carry credentials. Run-time inputs come from the start form, and site logins live in your desktop’s own browser profile — nothing is uploaded.
Warning
Don’t paste tokens or passwords into Pack input fields either — inputs are recorded with the run.