When desktop reconnect wipes Grok Bot box secrets

Credentials stored with Grok Bot’s secure secret input (the box secrets store) can disappear overnight even when you never clicked Update Grok Bot’s Computer or Reset. Staff (Colin, Sep 8, 2026) confirmed the cause: when the desktop app reconnects to your Grok Bot computer (sleep, network drop, quit/reopen), it re-syncs the app’s own secrets list and that sync currently overwrites secrets that were saved only through the in-chat secure input. Thread: forum 171029.

How it shows up

1. You store Client ID / Client secret (or similar) via the secure secret card — not pasted into ordinary chat.
2. A routine reads those secrets later (for example to mint a short-lived Admin API token into an agent folder).
3. After the PC sleeps or you close and reopen the desktop app, the secrets store is empty.
4. Files you wrote under an agent folder (token caches, notes) can still be there. Only the secrets store was overwritten.

On the Sep 7–8 reports, both wipes lined up with evening reconnects. Re-entering the same secrets through the secure input restored the morning refresh immediately.

What to do while staff tracks the fix

1. Treat reconnect-wipe as a known product bug. You did nothing wrong if Update / Reset stayed untouched.
2. After any overnight sleep or desktop quit/reopen, open the secrets store before a credential-dependent routine fires. Re-enter missing values through the secure input.
3. Keep short-lived tokens in an agent folder file only as a bridge. That file can outlive a wipe until the token expires; it is not a durable substitute for Client ID / secret.
4. Prefer a first-party or marketplace connector when one exists for the vendor (Shopify Admin MCP path: Manage a Shopify store from Grok Bot). Connectors avoid parking long-lived client secrets in the box store.
5. Reply on the forum with app version and whether the wipe followed sleep vs quit/reopen so staff can verify the fix.

Pitfalls

• Assuming Auto-update when idle or a silent Update ran — staff said those were not required for this wipe.
• Pasting Client secrets into chat “so they stick.” That is worse for security and is not the durable path.
• Distinct from stdio MCP secrets tied to a deleted agent identity — different store and failure mode.