Keys and vault
Your API keys are neither in your projects nor in the app’s database. They go into the Windows vault. This page tells you where to enter them and how to remove them.
The Windows vault
Section titled “The Windows vault”This is the Windows Credential Manager, tied to your session. Island Pilot writes your keys there and reads them back when a service needs one. It never displays them to you again.
It also hides their value in its logs and in tool results: you read [secret masqué] (hidden secret) there.
Where to enter each key
Section titled “Where to enter each key”| Service | Field | Where |
|---|---|---|
| xAI · Grok | Clé API xAI (xAI API key) | Paramètres › Comptes IA (Settings › AI accounts) |
| OpenCode Zen | Clé API OpenCode Zen (OpenCode Zen API key) | Paramètres › Comptes IA |
| OpenCode Go | Clé API OpenCode Go (OpenCode Go API key) | Paramètres › Comptes IA |
| Gemini images | Clé Gemini API pour les images (Gemini API key for images) | Paramètres › Comptes IA |
| Meshy | Clé API Meshy (Meshy API key) | Store & connexions (Store & connections), Meshy page, Configuration tab. Or the Création 3D (3D creation) step of the welcome |
| Tripo | Clé API Tripo (Tripo API key) | Store & connexions, Tripo page, Configuration tab |
Two cases have no key:
- Codex, Claude Code and Gemini CLI keep their session in their own programs. Island Pilot neither reads nor copies these sign-in tokens. See Connect an AI account.
- Higgsfield connects with your account, on its page. The authorisation is kept in the vault. See Higgsfield.
Save or replace a key
Section titled “Save or replace a key”- Stop the agents that are running: keys do not change while they work.
- Open the right place, following the table.
- Paste the key into the field.
- Click Enregistrer (Save), or Enregistrer la clé (Save the key) for Meshy and Tripo.
A new value replaces the previous one. You cannot read a key back: keep it with the service that created it.
Delete a key
Section titled “Delete a key”In Paramètres › Comptes IA, click the bin icon next to Enregistrer, then confirm. The services that use this key will have to be reconnected.
If a key has leaked
Section titled “If a key has leaked”- Revoke it with the service that created it. That is the step that makes it unusable.
- Create a new one.
- Save it in Island Pilot.
What else the vault contains
Section titled “What else the vault contains”Island Pilot also keeps your account session, your licence and the Blender link key there. It manages them itself, and you will not see them in the app. Se déconnecter (Sign out) removes the session.
What the vault does not protect
Section titled “What the vault does not protect”- It is open for as long as your Windows session is. A malicious program run under your account can reach it.
- A key that a service has received follows that service’s rules, and its use is billed to your account.
- An MCP server that you add keeps its own rights on your system. Only add servers you trust.
Custom MCP servers
Section titled “Custom MCP servers”In a server’s page, Référence du secret Bearer (facultatif) (Bearer secret reference (optional)) and Secrets et variables sensibles (Secrets and sensitive variables) ask for the name of a secret that is already saved, never the key itself.