# Local credentials

> On the desktop, the tokens that keep you signed in never leave your machine. Google sign-in stores them in the macOS Keychain or the Windows Credential Manager; local gcloud (ADC) doesn't copy anything and asks gcloud for a fresh token instead. This page covers how to find them, clear them when a sign-in is stuck, and revoke them when you hand the machine on.

Source: https://docs.querylab.io/desktop-app/local-credentials/

**Settings → Privacy → Google Credentials**

<div class="set-g">Local credentials (this device)</div>
    <p class="set-hint">Scopes: BigQuery</p>
    <p class="set-hint">Stored securely in macOS Keychain.</p>
    <p>
      <span class="btn outline sm">Clear local credentials</span>
    </p>
    <p class="set-hint">
      You can manage third-party access in your Google Account security
      settings. Open Google Account
    </p>

On the desktop the section shows the local entry and its scopes (BigQuery, plus Google Drive once granted). The server-stored block above it only appears if you also used the web app.

## Where they are

Your Google sign-in is stored in the macOS Keychain and stays on this device. Every entry is filed under the service name `querylab.io.desktop`; search for that in Keychain Access. On Windows, the sign-in is in Windows Credential Manager instead.

> **macOS may ask once.** If macOS shows a keychain prompt for Querylab, click **Always Allow**.   Clicking **Deny** doesn't break anything; the app treats it as "no token" and   shows the sign-in screen again.

With local gcloud (ADC), nothing is copied: the app asks gcloud for a token whenever it needs one, and your credentials stay where gcloud put them. See [Use existing gcloud auth](https://docs.querylab.io/desktop-app/gcloud-auth/).

## Removing credentials

From the mildest to the most thorough:

### Sign out

Account menu (top right) → **Logout**. Signs you out on this device. Prism AI keys stay.

### Clear local credentials

Settings → Privacy → Google Credentials → **Clear local credentials**. Same effect as sign-out, with a confirmation:

<p>
      This will sign you out of the desktop app. You'll need to sign in again.
    </p>
    <p>☐ I understand I'll need to sign in again</p>

### Reset Sign-In

**Help → Troubleshooting → Reset Sign-In...** is the reset for a sign-in that's stuck. It asks for confirmation, clears the sign-in on this device and reloads the app. Use it when the app shows a sign-in error you can't get past.

### From the OS

Deleting the `querylab.io.desktop` entries in Keychain Access works too. Restart the app afterwards.

## Revoking the grant at Google

Removing a token locally doesn't tell Google. To revoke the grant itself, remove Querylab.io under [Google Account → Third-party access](https://myaccount.google.com/permissions), or for ADC run `gcloud auth application-default revoke`.