Signing in
How people at Exprezoe sign in to Quikap and QuikapStudio with Exprezoe Identity in place of a license key, what the programs keep afterwards, and how to sign out.
Who this is for
Signing in is for people at Exprezoe. It replaces a license key: an installation that is signed in is entitled to updates for as long as the account is. Nobody else needs to sign in to use either program, and neither program has an account of its own.
Signing in
- In Quikap or in QuikapStudio, choose Help › License, then Sign in with Exprezoe Identity.
- Your browser opens at Exprezoe Identity. Sign in there as you always do, with your second factor.
- The browser says that you can close the tab, and the program shows your name.
Neither program ever sees your password and neither asks for it. There is no place in them to type one. If a window that looks like Quikap or QuikapStudio asks for your Exprezoe password, it is not one of them.
What happens, step by step
| Step | What it means |
|---|---|
| The program asks this site for a challenge | A one-time value, issued to that installation, that the sign-in must carry. A sign-in started anywhere else cannot be used here. |
| The program listens on your own computer | On 127.0.0.1, on a port chosen for this one sign-in. Nothing outside your computer can reach it. It stops listening when the sign-in ends, and after five minutes in any case. |
| Your browser opens | With a one-time proof (PKCE) that only this program can complete. |
| You sign in | At Exprezoe Identity, in your browser. |
| The answer comes back to your computer | The program checks that it belongs to the sign-in it started, then shows it to this site once. |
| This site checks it | The signature against Identity's published keys, the issuer, the audience, the lifetime, that the sign-in is fresh, that a second factor was used, that the challenge is the one it issued and has not been used, and that the person may use the programs. It answers with an entitlement, like an activation with a key. |
What the program keeps
The entitlement, in the operating system's protected storage for your account. It is not your password and cannot be turned into it. It can be revoked, on this site, at any time, and it ends by itself.
The program does not keep what Identity sent. It is used once and dropped.
Signing out
Choose Help › License › Deactivate. The program tells this site to end the entitlement and removes it from the protected storage, whether or not this site could be reached. On your account page you can do the same for any of your installations.
Signing out of a program does not sign you out of Exprezoe Identity in your browser.
When it does not work
| The program says | It means |
|---|---|
| Staff sign-in is not switched on for this site yet | This site has no identity provider configured. Nothing is wrong with your account. |
| The sign-in was not completed | The browser tab was closed, or five minutes passed. Start again. |
| Sign in with a second factor | Identity signed you in without one. Use your authenticator or your security key. |
| Your account is not in a group that may use Quikap | Ask an administrator. |
| This sign-in was already used | The same sign-in was shown twice. Start again. |