Data, credentials, and privacy

RouteKit keeps credentials and daemon state under ROUTEKIT_HOME (default ~/.routekit) and router config under ~/.config/routekit/router.yaml. Gateway access requires a bearer token.

Files stored on your machine

Router YAML rejects inline credentials. API keys come from provider environment variables. Subscription OAuth credentials managed by the local daemon live in private account files. routekit cloud account login instead captures a fresh credential in memory and sends it to the selected RouteKit Cloud origin, where it is encrypted at rest; it does not write the provider credential to a local subscription account file. Enrollment is always private. A later login with the same kind and label resumes that Source without repeating provider authorization; --reauthorize is required to replace its credential.

routekit cloud account list and show return only safe Source metadata and never credential values. Pooling is a separate explicit mutation. Account labels are management metadata: renaming one never changes its public subscription model namespace, which remains codex/* or claude-code/*.

Gateway authentication and network access

The gateway binds to loopback by default. Non-loopback binding requires an explicit authentication token, and enrolled remote clients use named tokens instead of the owner token. Tokens are compared through fixed-length digests and constant-time comparison.

Coding tool credentials

Persistent Codex and Claude Code installs receive dedicated gateway tokens. RouteKit stores their token IDs, target ownership, and client config paths in $ROUTEKIT_HOME/integrations/native-clients.json; the credential itself stays in a private 0600 file under $ROUTEKIT_HOME/secrets/ on every platform. Native clients request it through the RouteKit credential helper instead of embedding it in their settings. uninstall revokes a tracked token and removes only RouteKit-owned client configuration.

routekit cloud install uses a separate organization-bound user API key and CLI OAuth session, also kept in RouteKit's private secret store. It does not copy those values into Codex or Claude settings. A Cloud sidekick MCP install uses the CLI OAuth identity and has a separate lifecycle; cloud logout does not remove its MCP entry.

Where model traffic goes

Model traffic goes to the providers you configure. Aggregator routes such as OpenRouter forward prompts to upstream providers under their terms. Provider terms, subscription eligibility, quotas, and billing still apply.

See the routes and billing disclosure for credential ownership, egress, fallback, and qualification status by route.

Optional telemetry

Product telemetry is off by default and requires routekit telemetry on (or a truthy ROUTEKIT_TELEMETRY). Enabled events go to PostHog US by default using RouteKit's bundled project token; a non-empty ROUTEKIT_POSTHOG_KEY can override it. Events use a random anonymous install ID. DO_NOT_TRACK=1 always disables capture. No PostHog client or request is created while disabled.

Telemetry records fixed command/operation names and hourly bucketed gateway usage and reliability summaries. It never includes prompts, bodies, credentials, account/principal labels or IDs, paths, CLI arguments, raw errors, hashes, exact cost, exact token counts, or exact timestamps. Canonical provider and model names are included only in aggregate gateway summaries.

Use routekit telemetry status, routekit telemetry category <usage|reliability|adoption> <on|off>, routekit telemetry schema, and routekit telemetry reset to inspect or change controls. Remote commands follow the consent policy of the daemon they contact. This product telemetry is separate from local call attribution/leaderboards and operator-configured OTLP tracing. See the complete telemetry inventory.