Authentication

The Sun Studio desktop application requires a Sunny Labs account before opening the editor, restoring tabs, or running code. Authentication is provided by Logto at https://auth.sunnylabs.tech.

A network connection is required to sign in and to confirm a saved session when Studio starts. There is no offline sign-in or option to disable authentication. The standalone Sun CLI does not require a Studio account.

Studio uses the OAuth device authorization flow. Your password is entered only in the system browser, never in the editor or an embedded login window.

• Open Sun Studio and select Entrar com Sunny Labs.
• Studio displays a short access code. Select Continuar no navegador to open the Sunny Labs verification page in your default browser.
• Sign in with your Sunny Labs account and confirm the displayed code if requested. Approve only a code matching the one shown in your Studio window.
• Return to Studio. The editor opens automatically after the server confirms authorization; there is no callback URL to paste.
• Use Cancelar to abandon the request. An expired or refused request leaves the editor locked; start again to obtain a new code.

Studio can remember your session by encrypting a refresh token with the operating system's secure storage. It confirms that credential with Logto at startup and stores the latest token after refresh rotation.

If secure storage is unavailable, the session stays in memory only. Closing Studio requires another sign-in. Settings displays a notice for this mode; on Linux, the basic_text backend is deliberately not used to persist credentials.

Expired access sessions are renewed before protected actions. If renewal fails, Studio locks the editor and stops the language engine. Sign in again to continue; there is no automatic replay of your program.

Open the gear icon for Configurações, find Conta Sunny Labs, and select Sair da conta. Stop any running command first. Studio asks for confirmation before ending the runtime session.

• Variables, registered functions, figures, and active runtime state are discarded.
• Local files are not deleted. When tab restoration is enabled, Studio preserves the latest editor recovery before signing out.
• The local credential is removed before sign-out is confirmed, and Studio attempts to revoke the token with Logto.
• If credential removal fails, the error remains visible and a new login is blocked until cleanup succeeds. Check access to the application data directory and retry.
• Signing out of Studio does not sign the browser out of other Sunny Labs applications.

Authentication does not upload your source files or workspace variables to Logto. The login service verifies your identity; editing and execution continue locally.

Tokens remain in Electron's main process. The interface receives your public profile and login status, not access or refresh tokens. Persistent refresh credentials are encrypted in auth-session.bin; tokens are not stored in browser storage or editor recovery snapshots.

• Browser did not open: use the verification address displayed in Studio and enter the current code manually.
• Code expired or authorization refused: select Entrar com Sunny Labs again and use the newly displayed code.
• Session cannot be confirmed: check the connection to auth.sunnylabs.tech and try signing in again. A saved credential does not enable offline access.
• Login is required after every launch: check the session notice in Settings and whether the operating system's secure keyring is available. Do not enable plaintext credential storage as a workaround.
• Secure session cannot be saved: unlock or repair the system keyring, then retry. Studio does not fall back to writing a plaintext token.
• Sign-out cannot remove a saved credential: check permissions and write access to the Studio application data directory. Do not share the credential file when requesting support.

The desktop app is a public OAuth client using the openid, offline_access, and profile scopes; it contains no client secret. Electron main owns device-code polling, trusted OIDC discovery, signed ID-token validation, userinfo, refresh, and revocation. File access, execution, and inspection IPCs require a valid session independently of the visible login screen.

The login gate controls access to the desktop application. It is not local-file encryption, a license server, or authorization for a future hosted API. Any protected API must validate tokens and permissions on its own server.