Why is API and for email generator and settings for pass phrase dropping out and not saved?

Almost all the time, the API keys to be able to enable keys to create email alias for Duck or others are deleted and I have to add the API over and over agian. Cant see any specific on when this happens, sometime it can work a couple of days, and sometimes it seems to be saved just during current session and if I logg out, the API and pass phrase settings is set as I log in for the first time.

I saw a post here about it, and someone from BW said they are working on it, that post was made 2022, only four years ago. Seems not to be worked on at all, why?

Hello and welcome back :waving_hand:

You log out, and the keys are gone. I think that’s intentional; they don’t leave any of your secrets behind, even encrypted, after you’ve logged out, and the keys appear to be among those items.

You can verify this with the desktop app; look at the data.json file in the Bitwarden directory. If you use DuckDuckGo and search that string, you will eventually see something like this:

“user_xxx_extension_forwarder”: {
“duckduckgo”: {
“forwarder”: {
“id”: null,
“secret”: “…”

where “secret” is the encrypted key. Once you log out, this information is gone.

@ulfelf The API key and generator settings persist when you lock / unlock the BW apps instead of logging out / logging in.

But what about all other “secrets” like passwords, they dont get destroyed, and after all, I think those secrets are far more to be protected, or what do you think?
Why not store it just like the other secrets instead of making me crazy about this behaviour, if they are writing to disc, then I think that can be a security risk also, if for example you just cut the power to the computer and BW dont get time to delete it.

@Nail1684 Will try a new behaviour from me, I almost always log out since it is convinient to be able to log in using another device like phone.

I’m not sure I can follow that entirely. – When you log out, the local vault data gets removed, including API keys and generator settings in most cases.

(–> Automatic Logout or Lock | Bitwarden)

When you just lock a BW app, the vault data doesn’t get removed – but it’s still protected, and the security depends also on your unlock method.

  • you can choose a strong PIN and check “Require master password on browser restart”
  • you can use biometric unlock
  • if you don’t use any of the former two, you can also unlock with your master password
  • “unlock with passkey” would be another alternative

If you change to locking / unlocking then you should change your session timeout action to “Lock” (instead of “Log out”).

Thanks, sorry for being fuzzy, but now think you explained so evan an old man from Sweden should understand :wink: I think I never checked the “Require master password on browser restart” but will try it out now

Thanks a lot for your great support!

:+1: :wink:

I added that, because it’s more secure to check that option when using unlock with PIN.