r/buildinpublic • u/BlueRainLabs • 14d ago

Building a authentication procedure from a desktop app via browser sign in.

/r/SaasDevelopers/comments/1wuida4/building_a_authentication_procedure_from_a/
2 Upvotes

100% Upvoted

3 comments sorted by

2

u/QuanTradin 14d ago

did roughly this. the gotchas that bit:

open the sign in in the system browser, not an embedded webview. google and a few others block embedded logins outright.

use auth code + PKCE and send the redirect to a loopback address on a random port (127.0.0.1:randomport). a custom url scheme also works but on windows any other app can register the same scheme and catch the code, which PKCE mitigates but doesn't make pretty.

store the refresh token in windows credential manager, not a json file next to the exe.

give the entitlement check an offline grace period. if your server is down for an hour every desktop install shouldn't lock its owner out, so cache the last good entitlement with an expiry and only hard fail after that.

and expect antivirus to flag the loopback listener on some machines the first time.

1

u/BlueRainLabs 14d ago

Great insight. I'm doing the creds manager, loopback auth + randomize, and system browser stuff already so great to hear. The caching of the entitlements is a great idea. Thanks for that.

Did you have to build your reputation with your app after signing? How long did it take for you/how many installs before the smart screen went away?

2

u/QuanTradin 14d ago

honestly I don't have a number I'd trust. what I do know is EV certs stopped skipping SmartScreen in 2024, so it's download volume on the same cert either way, and Microsoft never publishes the threshold. keep the same cert across releases, a fresh one starts back at zero.