Tokens and secrets

• Stored: in your Codevre account, one field per provider (OpenRouter, Anthropic, OpenAI, Gemini, xAI).
• Used: Codevre's AI endpoints look up your key server-side and call the provider. Chat and completion requests from your browser don't include the key.
• Shown: masked in the Agent settings, e.g. sk-or-v1-…abcd. Your own signed-in session can read the key to show its status. It isn't written to local storage.
• Never sent to: the Nodepod runtime, the preview, process.env or project files.
• Checked: OpenRouter keys are checked from your browser against openrouter.ai/api/v1/key. Other providers are checked server-side.
• Removed: Remove key deletes it from your account.

See Providers and API keys.

Connecting GitHub stores an OAuth token with your account. Codevre treats it as a capability of the IDE that your code never holds:

1. The runtime only sees CODEVRE_GITHUB_LINKED=1 (or 0). The token itself is never in the environment, because Nodepod exposes environment variables to project code as process.env.
2. When Source Control pulls, pushes, fetches or clones, the token is attached to that single git invocation.
3. When you type a single plain git clone|fetch|pull|push|sparse-checkout … line in the terminal, the IDE runs an authenticated copy of exactly that command.
4. Commands with ;, &, |, <, >, `, $, several lines, or input from tasks, templates or the Agent don't get the token. They run unauthenticated.

So npm scripts, postinstall hooks, Node programs, startup tasks and the Agent can't read or use your GitHub access.

Disconnecting restarts the runtime, which drops the credential immediately. You can also revoke Codevre's access in your GitHub settings under Applications.

See GitHub.

Plus whatever you set in a command (PORT=4000 node server.js) or in a task's options.env.

Codevre doesn't treat .env or any other file specially:

• .env files are saved with the project and follow its visibility. In a public or unlisted project, anyone who can open it can read them.
• They're included in Download Project zips.
• Nodepod's Git doesn't support .gitignore, so git add -A will stage .env. Stage files selectively, or keep secrets out of the repository.
• The Agent can read any project file, so file contents can be sent to your AI provider as context.

Recommendations:

• Keep projects with secrets private.
• Prefer test or restricted keys while developing in the browser.
• Don't paste secrets into Agent chats. Chats are saved with the project.
• Code that runs in the browser preview exposes anything it contains to whoever opens the page. Put real secrets behind a server you deploy elsewhere.
• If a secret was exposed, revoke or rotate it with the issuer.

Settings, recent items and caches live in your browser's storage for codevre.com and preview.codevre.dev. They hold no AI keys or GitHub tokens. Clearing site data removes them. See the Privacy Policy.