Keys and sign-ins
Your Jira sign-in lives in the macOS Keychain, guarded by Touch ID where the system allows it, like a password manager.
The credential PrivateGoat holds for Jira is your Atlassian sign-in. It is stored in the macOS Keychain, not in a file in the app's folder, and macOS guards it the way it guards a password-manager entry. With the encrypted vault on, the key that opens the vault is kept in the same Keychain, on this Mac only, and is released by Touch ID or your login password.
How to use it
- Connect Jira, if you use it: Settings → Jira → Connect Jira…, then Connect with Atlassian. Without Jira, PrivateGoat holds no Atlassian credential. The grant is created during the browser sign-in and written to the Keychain (see Connect Jira).
- Where the build can use the data-protection Keychain, the app reads the credential once per launch: macOS asks for Touch ID, or for your login password as the fallback, and later syncs in the same launch do not ask again. Otherwise the item is guarded by the login keychain, which shows its usual password prompt when the grant is first read; that read is then held for the session too.
- To remove it, use Sign Out of Jira… in the Jira surface and choose Sign Out and Keep the Copy or Sign Out and Delete the Copy.
There is no PrivateGoat account, so there is no second password to remember and nothing to reset.
What is in the Keychain
| Item | Where |
|---|---|
| The Atlassian OAuth/MCP grant | The macOS Keychain (the data-protection Keychain, or the login keychain as a fallback); the app reads it when it needs it and keeps it in memory where it can |
| An API key for a summary server, if you gave one | The macOS Keychain, one per server address; sent only to that address |
| The key that opens the encrypted vault, when the vault is on | The macOS Keychain, on this Mac only; released by Touch ID or your login password |
| Jira account rows, scopes, issues and the operation ledger | ~/Library/Application Support/Sonavia/jira.sqlite3 — these are not secrets |
The grant is not written to a file the app can read back as text. The database holds the account and its scopes, so the app knows which site is connected without holding the credential itself.
Settings
| Setting | Where | Notes |
|---|---|---|
| Connection status and Open Jira in PrivateGoat | Settings → Jira → Connection | Signing in and out happen in the Jira surface |
| Enable editing in Jira | Settings → Jira → Editing | A write scope, requested at sign-in or on reconnect |
What leaves your Mac
Nothing that this page adds: the credential is presented to Atlassian when the app talks to the Jira gateway, which is the same request described on What leaves your Mac. The Keychain entry itself never leaves the Mac.
When it is off or fails
- The Touch ID prompt is cancelled: the app reports the grant as locked rather than signed out; nothing is deleted, and the next read asks again.
- The grant is revoked in Atlassian: the app asks you to sign in again; a draft in a sheet is kept.
- The Mac has no Touch ID, or the build is not signed for the data-protection Keychain: the file keychain guards the same item, with the login password prompt.
- You sign out: with the copy kept, the local Jira copy stays readable and syncing stops.
- A read-only grant: it is not a Keychain failure — reconnecting asks for the write scope if you want editing.
Related
- Connect Jira — the sign-in itself.
- What stays on your Mac — everything that is a file, and this exception.
- The encrypted vault — the key kept here when the vault is on.
- Create and edit tickets — what the write scope enables.