> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qredence.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Config directory layout, environment variables, and auth storage.

Fleet Prime Agent stores everything under one config directory and reads a small set of environment variables.

## Config directory

`~/.prime/agent/` (set by `APP_NAME` and `CONFIG_DIR_NAME` in `packages/coding-agent/src/config.ts`).

| Path             | Purpose                                               |
| ---------------- | ----------------------------------------------------- |
| `auth.json`      | Provider API keys and OAuth credentials. Mode `0600`. |
| `sessions/`      | One append-only file per session.                     |
| `logs/`          | Daemon, kernel, and web logs.                         |
| `kernel-venv/`   | Managed Python environment for `prime-agent-runtime`. |
| `telemetry.json` | Batched telemetry events (opt-in only).               |

## Environment variables

| Variable                    | Purpose                                                                                                |
| --------------------------- | ------------------------------------------------------------------------------------------------------ |
| `PRIME_AGENT_KERNEL_PYTHON` | Point at an existing Python environment instead of using the managed `kernel-venv/`.                   |
| Provider API keys           | See `packages/ai/src/env-api-keys.ts` for the full list (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.). |

Strip ambient keys for a single run with `--no-env`. Forwarding from client to daemon is limited to the keys named in `DAEMON_CLIENT_ENV_KEYS` (`packages/coding-agent/src/modes/daemon/daemon-protocol.ts`).

## Auth storage

`FileAuthStorageBackend` reads and writes `auth.json`. Concurrent processes coordinate through `proper-lockfile` so refreshing an OAuth token from one client doesn't race a read from another. `auth.json` supports both API-key and OAuth entries.

Inline keys passed with `--api-key` go through `setRuntimeApiKey` and never touch disk.

## Related

* [Providers and models](/fleet-prime-agent/guides/providers-and-models) — how credentials are loaded per turn.
* [Security](/fleet-prime-agent/reference/security) — trust model and credential handling.