Desktop Native Sign-In

Imagine you’re at a hotel front desk, and the clerk asks for your ID. You could hand over a photocopy—but that feels risky. Instead, you show your actual ID, they glance at it, and you keep it in your pocket. That’s what native sign-in does for apps: it lets you prove who you are without ever handing over the keys.

When you connect the Hermes Desktop app to a dashboard protected by a login system (like Google or GitHub), the app needs to verify you. There are two ways it can do this—and the good news is, you don’t have to choose. The app automatically picks the best one.

The Old Way: Embedded Sign-In (Legacy)

In the past, apps opened a tiny browser window inside the app itself. You’d type your username and password again, redo two-factor authentication, and hope your password manager worked. Spoiler: it often didn’t.

This method also relied on grabbing a “session cookie” from that mini-browser—like a temporary ID badge that could expire or get lost.

The New Way: Native Sign-In (RFC 8252)

Native sign-in is the modern, secure approach. Here’s the simple version:

• The app opens your real browser (Safari, Chrome, Firefox, Edge—whatever you use).
• You log in there, with all your saved passwords, extensions, and passkeys working normally.
• The app receives its own special tokens—like a keycard that only works for your room.

No embedded browser. No session cookies. Just a clean, secure handshake.

How It Actually Works

Here’s the behind-the-scenes flow, simplified:

1. Desktop app opens a private "listening" spot on your computer (loopback address)
2. Your system browser opens the login page
3. You approve and get redirected back to the app
4. The app exchanges a secret code for tokens
5. Tokens are stored securely in your OS keychain
6. All future requests use those tokens—no cookies involved

The gateway (the dashboard server) acts as a middleman. It talks to the identity provider (like Nous Portal) on your behalf, but you still get your own private login experience.

Why This Matters for You

• No re-typing passwords — your browser already knows you
• Passkeys and password managers work — no more fighting with tiny embedded windows
• Better security — the app uses short-lived tokens, and if one leaks, it expires quickly
• Your OS keychain protects everything — tokens are encrypted at rest

What If the Gateway Is Old?

If the dashboard doesn’t support native sign-in (it’s an older build), the app automatically falls back to the embedded browser method. You don’t have to do anything—the app checks the gateway’s capability first.

The Bottom Line

Native sign-in is like showing your real ID instead of a photocopy. It’s safer, smoother, and respects the tools you already use. The app handles all the technical decisions for you—you just log in and get back to work.

Practical tip: If you’re setting up Hermes Desktop with a self-hosted gateway, make sure you’re running the latest version. That way, you’ll get native sign-in by default—and you can skip the embedded browser entirely.