Where Does ZeroTier Store Identity and Config Files?
ZeroTier keeps identity keys, auth tokens, and joined networks in one working directory, fixed per operating system.
Last updated
Every ZeroTier node stores its cryptographic identity in a working directory whose path depends only on the OS. Two small files, identity.secret and identity.public, are the node's ten-digit address. Lose the secret and the node is gone. Copy it to two machines and both break in confusing ways.
The same folder holds authtoken.secret for CLI control and a networks.d subfolder where each joined network gets a conf file. Dropping a <network-id>.conf there before install is the standard trick for scripted deployments. The folder needs admin or root to even read.
Where ZeroTier stores this, by platform
C:\ProgramData\ZeroTier\One
identity.secret, identity.public, authtoken.secret, and networks.d live here. Requires administrator rights. Back up identity.secret like a password and never clone it across devices except for deliberate migration.
/Library/Application Support/ZeroTier/One
Same files as Windows and Linux. Join networks headlessly by placing <network-id>.conf files in networks.d before starting the service. Needs sudo to read.
/var/lib/zerotier-one
Standard home for distro installs (/var/db/zerotier-one on BSD). Allow a user CLI access by copying authtoken.secret to ~/.zeroTierOneAuthToken with mode 0600 instead of running everything as root.
Frequently asked questions
How do I migrate ZeroTier to new hardware?
Install ZeroTier on the new machine, stop the service, copy identity.secret and identity.public over, and restart. The node keeps its address and rejoins its networks. Copy deliberately for migration only. Two live nodes sharing one identity corrupt each other.
zerotier-cli says the auth token is missing. Why?
The CLI reads authtoken.secret from the working directory above, which needs elevation. Run as administrator on Windows or with sudo on Mac and Linux. For regular users, copy the token to ~/.zeroTierOneAuthToken owned by that user instead.
Notice an outdated path? Let us know.