> ## Documentation Index
> Fetch the complete documentation index at: https://sdk.docs.xano.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Config files

> Every file the Xano SDK reads or writes in a project and on your machine, what each one holds, and which ones to commit to git.

The Xano SDK keeps its state in plain files. Commit the ones that describe the project; keep the
ones that hold values, credentials or per-machine records out of git. A scaffolded project's
`.gitignore` already does this, and `xanosdk init` in an existing app adds the same rules as a
managed block.

## Project files

| File | What it holds | Commit |
| - | - | - |
| `xano/xano.lock` | Object identities and public URL slugs (`objects`), what this project wrote to each workspace and tenant (`landed`), and the sync baseline per workspace and Xano branch (`synced`). Every build writes it. | Yes |
| `package.json` `"xanosdk"` block | The Xano Engine version pin (`"@xano/sdk": { "engine": "v0.1.15" }`) and each toolchain module's config. | Yes |
| `xano.profile.json` | The credential profile this project acts as, written by `xanosdk profile use`. Holds a profile name, never a secret. | Yes |
| `xano/routes.gen.ts` | The route manifest your frontend imports: endpoint paths, verbs and request types. | Yes |
| `xano/.env.example` | The env names your backend declares, as commented lines. No values. | Yes |
| `xano/.xanosdk-codegen.json` | The marker and round-trip report a `pull` or `init --from` leaves in `xano/`. Its presence lets the next pull refresh `xano/` in place. | Yes |
| `AGENTS.md` | Instructions for coding agents, with a block the CLI keeps current (`--no-refresh` skips it). | Yes |
| `xano/.env` | The values of your backend's env vars. `env pull` fills it. | **No** |
| `xano/.secrets.json` | Documentation tokens a pull brought down and a deploy sends back. The SDK writes it; you do not edit it. | **No** |
| `.env.local` | `VITE_XANO_HOST`, the backend URL a deploy writes in a marked block for your dev server. | **No** |
| `.xano/deployed.json` | The tracked backend: the ephemeral or Xano Engine this project last deployed to. | **No** |
| `.xano/ephemeral.json` | This project's ephemeral and its landing record. | **No** |
| `.xano/auth.json` | The project-local credential, when you sign in with `login --local-auth`. `login` adds it to `.gitignore`. | **No** |
| `.xano/exports/` | Where a bare `xanosdk ephemeral export` writes. | **No** |
| `workspace.json` | A compiled bundle, written by `npm run xano:export`. | **No** |

<Warning>
  A compiled bundle carries your backend's env values and documentation tokens in cleartext. The
  scaffold ignores `workspace.json`, but not a bundle written to any other `--out` path. Keep every
  bundle out of git and out of shared build artifacts, and delete it after the deploy.
</Warning>

Everything under `xano/` except `.env` and `.secrets.json` is committed: the source is what a
reviewer reads. Do not ignore `xano/` wholesale. Ignoring `xano.lock` makes every build mint new
identities, so a rename becomes a delete and a create. See
[Git and merges](/govern/git-and-merges).

On a fresh clone, copy `xano/.env.example` to `xano/.env` and fill in the values, or run
`npx xanosdk env pull` to read them from a running backend. See
[Env and secrets](/build/env-and-secrets).

## Files on your machine

These live in your home directory and are shared by every project.

| File | What it holds | Moved by |
| - | - | - |
| `~/.xanosdk/auth.json` | The shared credential cache: your stored profiles. | `XANO_GLOBAL_CONFIG` |
| `~/.xano/xanosdk-clients.json` | The OAuth client registration per sign-in host. Not a credential. | `XANO_CLIENT_FILE` |
| `~/.xanosdk/update-check.json` | When the CLI last checked npm for a newer `@xano/sdk`. | `XANOSDK_UPDATE_CACHE` |
| `~/.xanosdk/local-engine/` | Xano Engine binaries, records of running Engines, and their logs and runtime data. Expect about 600 MB per Engine version. | `XANOSDK_ENGINE_HOME` |

Which credential file a command reads: `--config` or `XANO_CONFIG` first, then the project's
`.xano/auth.json` when it exists, then `~/.xanosdk/auth.json`. The `XANO_INSTANCE_URL`, `XANO_WORKSPACE_ID`
and `XANO_META_TOKEN` variables outrank every file. See
[Environment & identity](/reference/environment-variables).

## Next

* A tour of a scaffolded project: [What you built](/start/what-you-built).
* Every variable that moves these files: [Environment & identity](/reference/environment-variables).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.