Personal Cloud
What syncs
Since 0.6.0 Requires Cloak Proxy 0.6.0 or later.
What Personal Cloud syncs between your Macs, what always stays on each Mac, how secret values are handled, and how changes made on two Macs are merged.
Personal Cloud syncs the things you build in Cloak Proxy, such as rules, mock sets and API requests, so they’re the same on every Mac. It doesn’t sync anything that’s tied to one Mac, such as file paths, certificates, passwords and the switches that decide what runs on that Mac. This page lists both, explains how secret values are handled, and what happens when two Macs change the same thing.
Everything that syncs is encrypted on your Mac before upload. Subcloak can’t read it, and can’t read the names of your rules, requests or workspaces either.
Choose what syncs
Section titled “Choose what syncs”You choose during setup, and any time later in Settings › Cloud › What syncs. Each type shows its size and number of items. Turning a type off stops syncing it from this Mac; what’s already on this Mac stays.
| Type | On by default | What syncs |
|---|---|---|
| Rules, rule sets and folders | Yes | Every rule in the Tools window: Map Local, Map Remote, Rewrite, scripts, Block List, Allow List, breakpoints, Network Conditions, DNS Spoofing, alerts and failure scenarios, plus rule folders and rule sets and the order of each list. |
| Mock sets (including recorded responses) | Yes | Your mock sets and the responses recorded in them, without credential headers (see below). |
| Settings (a short list) | No | The SSL Proxying hosts and exclusions, the Bypass list, muted hosts, the external proxy (host and port, not its password) and client certificate hosts (not the certificate file or its password). |
| Scopes, saved queries, highlight rules and filters | Yes | Your scopes, saved queries, highlight rules and saved filters. Which scope is active stays on each Mac, and a change to the scope that’s active here waits for your review, because it decides what’s recorded or blocked. |
| API client workspaces | Yes | The workspace open in the API client: collections, folders and requests, environments, specs, flows, datasets, script packages and comments. Workspaces from your other Macs are listed too (see below). |
| Secret variable values (stay on this Mac unless you tick this) | No | The values of secret variables and saved auth credentials in that workspace. Only available when API client workspaces is ticked. See Secret values. |
Never synced: the root certificate, Keychain tokens, .env files, AI keys, and proxy and client-certificate passwords. The app shows this line under the list.
What stays on each Mac
Section titled “What stays on each Mac”Some parts of a synced item belong to the Mac it’s on. Cloak Proxy strips them before upload and keeps this Mac’s own value when a change arrives from another Mac.
Rules and tools
Section titled “Rules and tools”| Stays on each Mac | Why |
|---|---|
| The master switch of every debugging tool (Map Local, Map Remote, Block List, scripting, No Caching and the rest), the active rule set, and the Toxiproxy proxies | Switching a tool on from another Mac would change what this Mac’s traffic does. Toxiproxy proxies listen on this Mac’s ports. |
| Whether each script, Map Local, Map Remote, DNS Spoofing, Rewrite rule, mock set and failure scenario is on | These can run code, read local files, send traffic elsewhere or answer for a server. New or changed ones from another Mac arrive off: see Review changes. |
| Whether each rule folder is on | A folder you switched off here stays off, even if another Mac deletes and re-adds it. |
Recorded Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-API-Key and X-Auth-Token headers in mock sets |
They’re credentials or sessions from the Mac that recorded them. |
| Whether the external proxy is on, and its password | A proxy switched on from another Mac would route this Mac’s traffic through it. A proxy that another Mac adds or changes arrives off, without the old password. |
| The client certificate file and its password | The certificate’s file is on this Mac. A certificate rule whose host changes on another Mac doesn’t get this Mac’s file. |
Other settings never sync: ports, the macOS proxy, the root certificate, App Capture, the companion, Focus (which apps and hosts you record), retention, updates, the workspace’s location and every password.
API client workspaces
Section titled “API client workspaces”| Stays on each Mac | Why |
|---|---|
| Secret variable values and saved auth credentials, unless you tick Secret variable values | See Secret values. |
.env files and vault secrets |
Never synced. |
| Local file paths: binary bodies, form-data files, data source files (CSV, SQLite, JSON) and gRPC proto files | They point at files on this Mac. A request from another Mac arrives with these empty. |
| Unix socket paths | They point at this Mac. |
| Verify TLS certificates turned off, Skip TLS certificate verification, a database’s TLS mode and TCP TLS upstream | A change on another Mac never lowers this Mac’s guard. |
| A TCP server listening on every interface | It would open a port on this Mac. |
| Recorded credential headers in saved response examples | As for mock sets. |
| History, Recently Deleted, monitors, and flows’ schedules and webhooks | Monitors and scheduled flows would otherwise run on every Mac. |
Workspaces in a Git repository are left to Git. If the workspace folder is a Git repository, Cloud doesn’t sync it, and its row says “Git already syncs it”. See Workspace and Git.
In the API client’s workspace settings, next to the Git items, a workspace that syncs shows Syncs with Personal Cloud; one in a Git repository shows Left to Git: Personal Cloud doesn’t sync Git repositories. If Personal Cloud is on but workspaces aren’t ticked, Sync This Workspace… asks Sync API client workspaces with Personal Cloud?; Sync Workspaces turns on workspace sync. Without a plan, the button is greyed with a gold star and shows what Personal Cloud adds.
Workspaces from your other Macs
Section titled “Workspaces from your other Macs”Each Mac syncs the workspace it has open. Workspaces that another of your Macs syncs, and this Mac doesn’t have, are listed under What syncs as Not on this Mac, with how many requests and environments they hold. To get one:
- Click Add to This Mac… next to it.
- Choose an empty or new folder and click Add Here.
The workspace is downloaded into that folder and keeps syncing there from your other Macs. Its secret values come along only if Secret variable values is ticked, and the local paths listed above arrive empty. On a new Mac, Restore this Mac offers every workspace at once.
Secret values
Section titled “Secret values”API client workspaces keep secret values apart from requests: secret variables and saved auth credentials live in the workspace’s .cloak/ folder, not in its JSON files.
- By default they stay on this Mac. Requests sync without them. Each Mac keeps its own values.
- Tick Secret variable values to sync them too. They’re uploaded separately from the requests, and encrypted the same way. Tick it only if every Mac on your account should have them.
- Protocol passwords count as secrets: MQTT and database passwords, an API key typed into an AI request, and Socket.IO auth. A
{{variable}}in those fields syncs as written, because it names a secret rather than holding one. - The vault and
.envfiles never sync, whatever you tick.
Secrets go back only where they were used
Section titled “Secrets go back only where they were used”When a change arrives from another Mac, this Mac puts its own secret values, file paths and certificate settings back into the request, but only if the request still goes to the same place. Cloak Proxy compares where the request is sent after variables are filled in: its host, its environment’s URL variables, an OAuth token URL and the endpoints of other protocols.
If another Mac changed the destination, this Mac doesn’t put them back, and Sync issues says so: “Where this is sent changed on Mac (now host), so this Mac didn’t put its secrets, local files or certificate settings back. Enter them again if you trust the new destination.”
Items held back
Section titled “Items held back”If a synced item contains a secret value from this Mac in a field that isn’t marked secret, Cloak Proxy doesn’t upload it. Sync issues shows “Not uploaded: it contains a secret value from this Mac (a password or secret variable). Remove it from the item, or mark the field as secret.”
When two Macs change the same thing
Section titled “When two Macs change the same thing”Sync merges field by field. If one Mac renamed a rule and another changed its URL, you get both changes. A conflict only happens when both Macs changed the same field before syncing.
| What happened | What Cloak Proxy does |
|---|---|
| Both Macs changed the same field of an item | This Mac’s value is kept. If the item can be copied (a rule, a mock set, a request), the other Mac’s version is kept as a copy, and the issue says what it’s called. A copied rule is switched off, so two copies never both act on traffic. |
| An item was deleted on one Mac and changed on the other | The change wins and the item is kept. |
| An item is over 25 MB | It isn’t synced. Sync issues says it’s too large. |
Conflicts appear under Settings › Cloud › Sync issues as Changed on two computers. Click Review…, select the item and choose:
| Button | What it does |
|---|---|
| Keep This Mac’s | Keeps this Mac’s version and removes the copy. |
| Keep Other | Uses the other Mac’s version and removes the copy. If it’s a rule that can act on this Mac, it arrives off, as any change from another Mac does. |
| Keep Both | Keeps both versions. |
How sync runs
Section titled “How sync runs”- Changes are gathered for a couple of seconds after you make them, then uploaded.
- With Push connection connected, changes from your other Macs arrive right away. Otherwise each Mac checks every few minutes.
- Offline, changes wait on the Mac and upload when it reconnects. Sync Now in Settings › Cloud › This Mac syncs at once.
- Storage used counts the encrypted size, which is padded so the server can’t tell exact sizes.