Local credentials
On the desktop, the tokens that keep you signed in never leave your machine. Google sign-in stores them in the macOS Keychain; local gcloud (ADC) doesn't copy anything and asks gcloud for a fresh token instead. This page covers how to find them, clear them when a sign-in is stuck, and revoke them when you hand the machine on.
Scopes: BigQuery
Stored securely in macOS Keychain.
Clear local credentials
You can manage third-party access in your Google Account security settings. Open Google Account
Where they are
Your Google sign-in is stored in the macOS Keychain and stays on this device. Every entry is filed under the service name querylab.io.desktop; search for that in Keychain Access.
With local gcloud (ADC), nothing is copied: the app asks gcloud for a token whenever it needs one, and your credentials stay where gcloud put them. See Use existing gcloud auth.
Removing credentials
From the mildest to the most thorough:
Sign out
Account menu (top right) → Logout. Signs you out on this device. Prism AI keys stay.
Clear local credentials
Settings → Privacy → Google Credentials → Clear local credentials. Same effect as sign-out, with a confirmation:
This will sign you out of the desktop app. You’ll need to sign in again.
☐ I understand I’ll need to sign in again
Reset Auth State
Help → Reset Auth State (⌘⇧R) is the reset for a sign-in that’s stuck. It asks for confirmation, clears the sign-in on this device and reloads the app. Use it when the app shows a sign-in error you can’t get past.
From the OS
Deleting the querylab.io.desktop entries in Keychain Access works too. Restart the app afterwards.
Revoking the grant at Google
Removing a token locally doesn’t tell Google. To revoke the grant itself, remove Querylab.io under Google Account → Third-party access, or for ADC run gcloud auth application-default revoke.