It's your RSI login.

Rsi-Token is the cookie your browser holds after you sign in to RSI. It isn't a scoped API key and there is no read-only version of it — it is the session itself. Anything holding it can act as you on robertsspaceindustries.com for as long as it stays valid.

StarStats uses it for one thing: fetching your own hangar so it can list what you own. But we're not going to describe it as “just” hangar access, because the cookie doesn't know that's all we do with it.

Into your keychain, not our server.

The desktop app stores it in your operating system's keychain and uses it locally. The tray says it plainly: “Never leaves your machine — only parsed ship lists are sent.” The cookie stays put; what reaches us is the list of ships it produced.

DevTools, and nowhere else.

There is no nicer path, which is itself worth knowing. In your browser: DevTools → Application → Cookies → robertsspaceindustries.com → Rsi-Token. Copy the value and paste it into the desktop app's settings.

If a website ever asks you to do this, be suspicious. We ask because the app runs on your machine and the cookie never leaves it. A website asking for the same string is asking you to hand your session to a server.

We don't know, and won't pretend to.

There's no fixed expiry we can quote. It stops working whenever RSI decides your session is over — a password change, a logout, or their own timing. When it lapses, hangar refresh starts failing and the app tells you it needs a new one. That isn't a bug; it's the cookie doing its job.

Clear cookie, in the app.

The settings pane has a Clear cookie control. It removes the cookie from your keychain, and it warns you what you're giving up: “Clear the stored RSI cookie? Hangar refresh will pause until you paste a new one.”

That's the part we control, so it's the part we'll promise. What RSI does with the session on their side is theirs to answer, and we're not going to guess at it on your behalf.

The rest of the honest version.

/trust covers what leaves your machine, what StarStats sees about other players, and why it can't get you banned. Back to the quickstart.