Config files

The Xano SDK keeps its state in plain files. Commit the ones that describe the project; keep the ones that hold values, credentials or per-machine records out of git. A scaffolded project’s .gitignore already does this, and xanosdk init in an existing app adds the same rules as a managed block.

Project files

File	What it holds	Commit
`xano/xano.lock`	Object identities and public URL slugs (`objects`), what this project wrote to each workspace and tenant (`landed`), and the sync baseline per workspace and Xano branch (`synced`). Every build writes it.	Yes
`package.json` `"xanosdk"` block	The Xano Engine version pin (`"@xano/sdk": { "engine": "v0.1.15" }`) and each toolchain module’s config.	Yes
`xano.profile.json`	The credential profile this project acts as, written by `xanosdk profile use`. Holds a profile name, never a secret.	Yes
`xano/routes.gen.ts`	The route manifest your frontend imports: endpoint paths, verbs and request types.	Yes
`xano/.env.example`	The env names your backend declares, as commented lines. No values.	Yes
`xano/.xanosdk-codegen.json`	The marker and round-trip report a `pull` or `init --from` leaves in `xano/`. Its presence lets the next pull refresh `xano/` in place.	Yes
`AGENTS.md`	Instructions for coding agents, with a block the CLI keeps current (`--no-refresh` skips it).	Yes
`xano/.env`	The values of your backend’s env vars. `env pull` fills it.	No
`xano/.secrets.json`	Documentation tokens a pull brought down and a deploy sends back. The SDK writes it; you do not edit it.	No
`.env.local`	`VITE_XANO_HOST`, the backend URL a deploy writes in a marked block for your dev server.	No
`.xano/deployed.json`	The tracked backend: the ephemeral or Xano Engine this project last deployed to.	No
`.xano/ephemeral.json`	This project’s ephemeral and its landing record.	No
`.xano/auth.json`	The project-local credential, when you sign in with `login --local-auth`. `login` adds it to `.gitignore`.	No
`.xano/exports/`	Where a bare `xanosdk ephemeral export` writes.	No
`workspace.json`	A compiled bundle, written by `npm run xano:export`.	No

A compiled bundle carries your backend’s env values and documentation tokens in cleartext. The scaffold ignores workspace.json, but not a bundle written to any other --out path. Keep every bundle out of git and out of shared build artifacts, and delete it after the deploy.

Everything under xano/ except .env and .secrets.json is committed: the source is what a reviewer reads. Do not ignore xano/ wholesale. Ignoring xano.lock makes every build mint new identities, so a rename becomes a delete and a create. See Git and merges. On a fresh clone, copy xano/.env.example to xano/.env and fill in the values, or run npx xanosdk env pull to read them from a running backend. See Env and secrets.

Files on your machine

These live in your home directory and are shared by every project.

File	What it holds	Moved by
`~/.xanosdk/auth.json`	The shared credential cache: your stored profiles.	`XANO_GLOBAL_CONFIG`
`~/.xano/xanosdk-clients.json`	The OAuth client registration per sign-in host. Not a credential.	`XANO_CLIENT_FILE`
`~/.xanosdk/update-check.json`	When the CLI last checked npm for a newer `@xano/sdk`.	`XANOSDK_UPDATE_CACHE`
`~/.xanosdk/local-engine/`	Xano Engine binaries, records of running Engines, and their logs and runtime data. Expect about 600 MB per Engine version.	`XANOSDK_ENGINE_HOME`

Which credential file a command reads: --config or XANO_CONFIG first, then the project’s .xano/auth.json when it exists, then ~/.xanosdk/auth.json. The XANO_INSTANCE_URL, XANO_WORKSPACE_ID and XANO_META_TOKEN variables outrank every file. See Environment & identity.

A tour of a scaffolded project: What you built.
Every variable that moves these files: Environment & identity.

Overview

Authoring and config

CLI

Errors and formats

Project files

Files on your machine

Next

​Project files

​Files on your machine

​Next

Project files

Files on your machine

Next