Local credentials
On the desktop, the long-lived tokens that keep you signed in never leave your machine. Google OAuth puts them in the operating system's credential store; local gcloud (ADC) doesn't copy anything at all and asks gcloud for a fresh token instead. Knowing what sits where lets you inspect it, clear it when a sign-in is stuck, and revoke it when you hand the machine on.
Scopes: BigQuery
Stored securely in macOS Keychain.
Clear local credentials
You can manage third-party access in your Google Account security settings. Open Google Account
Where the store is
The app writes to the credential store the OS provides. Every entry is filed under the service name querylab.io.desktop, so that’s the string to search for.
| OS | Store | How to look |
|---|---|---|
| macOS | Keychain (login keychain) | Keychain Access → search querylab.io.desktop |
| Windows | Credential Manager | Control Panel → Credential Manager → Windows Credentials → querylab.io.desktop |
| Linux | Secret Service (libsecret) | secret-tool search service querylab.io.desktop (no Linux build ships yet) |
What is stored
Google OAuth sign-in
| Entry | Where | Lifetime |
|---|---|---|
google_refresh_token | Credential store | Until you sign out, or revoke it in your Google account |
app_refresh_token | Credential store | Renews the Querylab.io session (tabs, settings sync) |
backend_jwt | Credential store | 30 days; only present after you enable Prism AI |
byok_<provider>_key | Credential store | Your own AI provider key, if you added one under Prism AI |
app_jwt | Browser local storage | Short-lived session token, renewed from app_refresh_token |
| Google access token | Memory only | About 1 hour, then refreshed with the refresh token |
The Google refresh token is obtained by the app directly from Google over a loopback redirect (http://127.0.0.1:<port>/callback) and is never sent to Querylab.io. The only thing the backend sees at sign-in is a Google ID token, used to verify who you are. The full flow is on Authentication.
Local gcloud (ADC)
Nothing is copied. The app shells out to gcloud auth application-default print-access-token at launch and again once the token expires, and keeps the result in memory. All Querylab.io stores of its own is a note that you signed in this way, and with which scopes, so the next launch does the same. Your credentials stay where gcloud put them: ~/.config/gcloud/application_default_credentials.json on macOS and Linux, %APPDATA%\gcloud\ on Windows. See Use existing gcloud auth.
Removing credentials
There are three ways, from the mildest to the most thorough:
Sign out
Account menu (top right) → Logout. Clears the Google and Querylab.io tokens from the credential store and local storage, and the adc_mode flag. Prism AI keys stay.
Clear local credentials
Settings → Privacy → Google Credentials → Clear local credentials. Same effect as sign-out, with a confirmation:
This will sign you out of the desktop app. You’ll need to sign in again.
☐ I understand I’ll need to sign in again
Reset Auth State
Help → Reset Auth State (⌘⇧R on macOS, CtrlShiftR on Windows and Linux) is the reset for a sign-in that’s stuck. It deletes google_refresh_token and app_refresh_token from the credential store (the keyboard shortcut also drops backend_jwt), wipes every auth-related key in local storage, and reloads the window. Use it when the app shows a sign-in error you can’t get past.
Help → Debug Auth State shows which of these entries exist (“present” or “null”, never the values) so you can see what the reset is about to remove.
From the OS
Deleting the querylab.io.desktop entries in Keychain Access or Credential Manager works too, and is the only way to remove backend_jwt or a byok_… key by hand. Restart the app afterwards.
Revoking the grant at Google
Removing a token locally doesn’t tell Google. To revoke the grant itself, remove Querylab.io under Google Account → Third-party access, or for ADC run gcloud auth application-default revoke.