How Microsoft sign-in works in Xol

Xol signs you in with Microsoft's standard flow for desktop applications: OAuth 2.0 authorization code with PKCE, in your system browser. This page describes each step, what Xol receives and where it is kept.

Step by step

1. You press “Sign in with Microsoft”. Xol starts a temporary listener on http://localhost (your own computer, a random free port) and opens login.microsoftonline.com in your default browser. Xol does not embed a browser window, so your password manager, passkeys and two-factor prompts work as they do everywhere else, and you can check the address bar.
2. You sign in on Microsoft's page and approve the request. Microsoft shows you the application name and what it is asking for.
3. Microsoft redirects your browser to the local listener with a one-time authorization code. Because of PKCE, that code is useless to anything other than the Xol process that started the sign-in. The listener closes right after.
4. Xol exchanges the code for tokens directly with Microsoft. Xol is a public client: there is no client secret in the app and no Xol server takes part in the exchange.
5. Xbox Live and XSTS. The Microsoft token is exchanged at user.auth.xboxlive.com and then xsts.auth.xboxlive.com for a token scoped to Minecraft Services (rp://api.minecraftservices.com/).
6. Minecraft Services. Xol calls api.minecraftservices.com to obtain a Minecraft access token, checks that the account has the Minecraft: Java Edition entitlement, and reads the profile (username and UUID). If the account does not own the game, Xol stops here and says so.
7. Launch. The Minecraft access token is passed to the game process on your computer, exactly as the official launcher does, so you can join online-mode servers.

“Sign in with Microsoft” is the only sign-in offered to players. Development builds can also show a temporary test sign-in, in which you enter a short code on Microsoft's own page. It appears only when Settings ▸ Service ▸ Enable test sign-in (temporary) is on, or when a file named enable-test-signin is in the Xol data folder. It is never offered in beta or stable builds, and it will be removed once Microsoft approves Xol's own application.

What Xol asks Microsoft for

Xol does not request access to your email, contacts, files, profile photo or any other Microsoft data.

What Xol receives and where it is kept

On Windows the tokens are encrypted by the operating system (DPAPI). On macOS, current test builds are not signed with an Apple Developer ID; for such builds the Keychain asks for your login password, and asks again after every update, so they keep the sign-in in a file in the Xol data folder that only your own user account can read or write. That is file-permission protection, not encryption. A build signed with a Developer ID uses the Keychain. A sign-in saved in the Keychain by an older version is not read: Xol asks you to sign in once more.

None of the tokens, and not your UUID, is ever sent to Xol's servers, written to logs, or included in support files or crash reports. Your Minecraft username is sent only in the optional online heartbeat described in the privacy policy. Support logs are redacted on your computer before you see them.

Removing access

• In Xol: open the account menu and choose Remove account. The stored tokens are deleted from your device.
• At Microsoft: visit account.microsoft.com/privacy/app-access and remove Xol. Any tokens Xol holds stop working.

Messages you might see

• “This account does not own Minecraft”. Sign in with the account that bought Minecraft: Java Edition. Xol cannot launch the game without it.
• “This account has no Xbox profile”. Create one at xbox.com with the same Microsoft account, then sign in again.
• “This is a child account” or “Xbox Live is not available in this region”. Both come from Xbox Live. An adult must add a child account to a Microsoft family group before it can sign in to third-party apps.

Questions

Write to contact@xol.dev. Send security reports to the same address. They are answered first.