Identity and Licensing

Pitchblend Identity connects the desktop app to your Pitchblend account. It is
used to restore your session, show a safe license summary, and authorize
account-bound device sync.

It is separate from your local Geist data. Signing in does not upload chats,
memories, folders, model files, or your Geist database.

Normal packaged behavior

The packaged desktop app enables Identity against Pitchblend's built-in,
production identity authority and desktop client. Environment variables cannot
redirect a packaged app to a different identity provider.

The desktop control offers these workflows:

Sign in opens the system browser.
Cancel stops an in-progress sign-in.
The signed-in account menu shows your display name, avatar, and active license
tier.
Sign out clears the local session and then attempts provider sign-out.
Retry sign out appears if saved local credentials could not be removed.

See Account and Licenses
for the step-by-step interface guide.

Pitchblend uses the OAuth 2.0 Authorization Code flow with PKCE:

The desktop app opens the trusted identity service in your default browser.
A temporary callback listens only on 127.0.0.1 for this sign-in attempt.
The identity service returns the browser to that local callback.
The desktop app validates the response and exchanges the one-time code.
The callback closes, and the account control updates.

The local callback verifies the expected state and identity issuer. It rejects
ambiguous, malformed, oversized, or non-loopback requests. Its response page
stores nothing and instructs the browser not to cache or frame it.

Do not copy a callback URL or authorization code to another person. A normal
Pitchblend sign-in never asks you to paste one into the app.

The browser always offers Email me a sign-in link. Continue with
Google, Continue with Microsoft, or Continue with Apple appears only
when that provider is configured by the Pitchblend service.

For email sign-in:

Enter your email and request the one-time link.
Keep the Check your email page open. It displays a requester code and
waits for confirmation.
Open the emailed link before it expires. A link works once.
Enter a Display name when creating a new account. This does not
overwrite an existing profile.
If you opened the link in another browser or on another device, enter the
requester code shown where you began. Do not continue when you did not
initiate that request.

The original browser continues automatically after confirmation. An external
provider may also require an email proof when it cannot supply a verified
address. Pitchblend returns a generic response to email requests so the page
does not reveal whether an account already exists.

Protected session storage

Access tokens, refresh tokens, and raw license material stay in Electron's main
process. They are not exposed to the embedded Geist page.

When the operating system provides protected credential storage, Pitchblend
encrypts the refresh token with that facility and binds it to the configured
identity authority and desktop client. The app refreshes short-lived access in
the background and rotates consumed refresh tokens.

If protected storage is unavailable, Pitchblend does not save a refresh token
for the next launch. The current account session may still work until the app
closes, but Memory Sync remains unavailable because its device keys also
require protected storage.

What a license summary contains

The account control receives only limited license information, such as:

display name and tier;
issue, expiration, and revocation dates;
current status;
sync-device allowance; and
whether the license is eligible for sync.

It does not receive or display the raw license key, payment records, customer
record IDs, email address, or identity tokens.

The current desktop app has no Settings > License page and no field for
pasting a license key. Sign in with the Pitchblend account associated with the
license; the desktop app then loads its limited account-license summaries.

An active account license is not automatically sync-eligible. Eligibility
also depends on its current durable license or subscription state and its
device allowance. The Active license picker disables licenses marked
ineligible, but it does not pre-disable an otherwise eligible license whose
device seats are already full. Capacity is enforced during enrollment, which
can fail until a seat is freed or the allowance increases.

Source and developer behavior

Identity is opt-in in a source checkout. Developers must deliberately enable it
and select an allowed HTTPS authority or HTTP loopback authority. Packaged
builds ignore those authority/client overrides.

Source Identity configuration and attach-mode limitations are documented in
Developer Mode. These switches are
for local development, not an end-user account setting.

Failure behavior

Identity errors shown in the account control are intentionally short. They may
say that sign-in or session refresh failed because the service timed out,
returned an HTTP error, rejected the session, or failed security validation.
Sensitive provider response details are not copied into the Geist page.

A temporary refresh failure keeps a previously loaded account summary when it
is safe to do so and retries later. A definitive session or security failure
clears the local session. If credential deletion fails, Pitchblend quarantines
the saved session and asks you to Retry sign out rather than silently
restoring it on the next launch.

For recovery steps, see
Account and Sync Help.