Navide does not store your CLI account credentials and keys centrally in the cloud, and it never will. They stay only on your own machine. The "Credentials & keys" option in the sync settings was always disabled in the UI and was never available to turn on, and since 0.2.28 it has been removed.
Why we are saying this now
Recent security incidents across the industry have involved keys held in one central place:
- Zeabur had security incidents in August and October 2026. According to its official reports, an attacker read data from its platform database, including the environment variables of user services, which often hold API keys and database passwords. Zeabur asked all users to replace those credentials and announced on October 17 that it is winding down its service. (August report, October preliminary report)
- On October 17, OpenCode announced a security incident affecting its Console. As reported, third-party AI provider keys saved in cloud workspaces by about 1.4% of Console users may have been exposed, and OpenCode asked affected users to rotate them. (coverage)
We thank both teams for describing what happened in public, and our thoughts are with the affected users. These incidents are a reminder that when keys are kept in one place, a single breach affects everyone. So we are putting Navide's approach in writing.
What has already changed
- The "Credentials & keys" option in the sync settings was always disabled in the UI and was never available to turn on. Since 0.2.28 it has been removed from the sync settings.
- Navide Cloud sync handles only agent asset settings, such as prompts, skills, MCP and global instruction files. It does not include CLI account credentials and keys.
About MCP settings (a separate matter from account credentials)
MCP settings are not your CLI account credentials, but fields such as env often hold access tokens. So to be clear:
- Tokens inside your MCP settings are encrypted on your device before syncing; the server cannot decrypt them.
- They are uploaded only when MCP sync is on.
- You can turn off MCP sync at any time in Settings → Navide Cloud → Sync → MCP.
What does not change
- Local account credential management works as before: adding, switching accounts, viewing and removing are unchanged.
- To use the same account on several computers, sign in on each one.
Going forward
- Navide will offer an API token plan on a resale model: you buy usage from Navide and never hand your own keys to us. Details will follow in a separate announcement.
- Navide will not offer any centralized management of account credentials and keys.
Enterprise customers
If your team needs to sync account credentials across devices, we can set up a private cloud deployment so the data stays in an environment you control. Terms are arranged case by case.
Contact: email us at navide.dev@gmail.com
If you have stored keys on other platforms, we recommend rotating them as those platforms advise and reviewing recent usage and billing.