# Desktop Sign-In: Connect the App Without a Password

Sign in on the web, approve on the web, then return to the desktop app. No password is ever typed into or sent to the desktop app.

**Status:** live. Browser-based one-time exchange with fresh permission checks (migration 079). Verified with Chromium/WebKit proofs and real PostgreSQL assertions.

**On this page:** when to use it · steps · the code check · troubleshooting.

## When to use it

- You opened the CoreReflex desktop app (CoreReflex Capture / Studio) and it asks you to sign in.
- You are signing in on your own device, from the app itself. Only approve a request you just started.

## Step-by-step

1. **Start in the desktop app.** It shows a sign-in prompt and a short code (e.g. `4821-9053`). Leave the app open on that screen.
2. **Open the browser page.** Go to the sign-in URL the app shows (the `/desktop-sign-in` page). If you are not signed in on the web, click **Sign in on the web** first.
3. **Compare the code.** The browser page shows a code. Check that it matches the code in your desktop app, character for character.
4. **Check the box and approve.** Tick **"The code matches and this is my desktop app"**, then click **Connect desktop app**. The button stays disabled until you tick the box.
5. **Return to the app.** The desktop app admits you to Studio and the media library. The one-time exchange cannot be replayed: a used or expired code stops working.

To decline a request you did not start, click **Decline**. When in doubt, decline.

## Why this is safe (plain language)

- The desktop app never sees your password. The browser holds your session; the app receives a single-use, atomic exchange token.
- Each approval is checked against fresh permissions at the moment you click. Stale or reused approvals are refused.
- Codes expire. An attacker replaying an old screen gets nothing.

## Troubleshooting

| Symptom | Likely cause | Fix |
|---------|--------------|-----|
| Approve button stays grey | Checkbox not ticked | Tick "The code matches…" first |
| Code does not match | A second request started, or wrong device | Decline; restart sign-in from your app and compare again |
| "No sign-in request" / expired | Code timed out or already used | Restart sign-in from the desktop app for a fresh code |
| Signed in on web but app still locked | Exchange did not complete | Return to the app; if still locked, restart sign-in once |

## Related pages

- [Getting Started](getting-started.md): accounts, sessions, password reset.
- [Recording & Podcasts](recording-and-podcasts.md): what the desktop capture path feeds.
- [Files & Publishing](files-and-publishing.md): the media library you land in.