Provider authentication

How Kielo Desktop Node links your machine to your provider account.

Overview

Kielo Desktop Node uses a browser-based OAuth flow with PKCE — the same pattern as GitHub CLI or Claude Code. Your password never touches the desktop binary; the system browser handles sign-in and returns an authorization code to a local loopback callback.

Sign-in flow

Open Kielo Desktop Node and choose Sign in.
The app starts a temporary HTTP listener on 127.0.0.1 and opens your default browser to the Kielo sign-in page.
Log in with your provider account (or create one at register with role provider).
After approval, the browser redirects to the loopback URL with an authorization code.
The desktop app exchanges the code for access and refresh tokens via POST /api/auth/token.
Tokens are stored in the app's secure local storage — never printed to the terminal.

OAuth client

Field	Value
Client ID	`kielo-desktop-app`
Redirect	`http://127.0.0.1:<port>/callback` (dynamic port per session)
Challenge method	S256 (PKCE)

Create a provider account first

If you do not have an account, register as a provider before signing in to the desktop app:

http://localhost:3000/register?role=provider

Use the same email and password (or SSO) when the browser opens during desktop sign-in.

Already signed in

If valid refresh tokens exist locally, the app refreshes your session silently. Use Sign out in the desktop app to clear credentials and force a new browser login.

Node control-plane token

After registration, the node uses a node token for heartbeat, job polling, and telemetry back to the API gateway. This is separate from developer API keys used for inference requests. The desktop app manages token lifecycle automatically after onboarding.

Developer API authentication is documented in Authentication (API).

Troubleshooting

Browser does not open — copy the URL from the app and open it manually.
Loopback blocked — allow local connections; redirect must hit 127.0.0.1 or localhost only.
Wrong account role — provider onboarding requires a provider account; developer-only accounts should register with role=provider or add provider access in settings.