> For the complete documentation index, see [llms.txt](https://docs.kouch.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kouch.dev/docs/adr/0021-art-key-in-steam-cloud.md). # ADR 0021: The SteamGridDB key is kept in the OS secret store and synced encrypted through Steam Clou ## Status Accepted on 2026-09-28 (owner): *"the steamgriddb api key has to sync encryped with steam cloud"*. Plan: `docs/NAMES_AND_KEYS_PLAN.md` N2. It builds on ADR 0013, which puts Steam Cloud through the API only. ## Context * The user's own SteamGridDB API key sat in plain text in `/art.json`, so each PC needed it typed in again. * It's the only secret Kouch keeps for the user. * Steam Cloud stores files per Steam account and syncs them to every PC that account signs into. ## Decision * **Locally,** the key lives in the OS secret store: * Windows: Credential Manager / DPAPI; * Linux: Secret Service. * Where neither is available, a file encrypted with a machine-bound key. * `art.json` keeps only "a key is set". An existing plain key is migrated once. * **In Steam Cloud,** one file (`secrets.bin`) holds the key sealed with ChaCha20-Poly1305. The key comes from HKDF over the Steam account id plus a Kouch-held value, with a version byte and a random nonce. A tampered file or another account's file is rejected. * **The key never appears** in logs, diagnostics, reports, `.kod` exports, LAN transfers or the UI. ## Consequences and risk * **What the encryption covers:** the key isn't readable in the cloud file, in backups of Steam's userdata folder, or when files are copied around. * **What it doesn't cover:** anyone who has both the file and Kouch, while signed into that Steam account, can recover the key. Kouch has no user-held secret to encrypt with, and asking for a passphrase on every PC would defeat the point of syncing. The owner's ask is met at that level. A passphrase option can be added later if wanted. * Steam Cloud needs Kouch's own app id, like all of Steam Cloud, so the cloud half is tested live once the id exists. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.kouch.dev/docs/adr/0021-art-key-in-steam-cloud.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.