Sign-in
How Microsoft sign-in works in Xol
Last updated 18 September 2026
Xol signs you in with Microsoft's standard flow for desktop applications: OAuth 2.0 authorization code with PKCE, in your system browser. This page describes every step, what Xol receives, and where it is kept.
Step by step
- You press “Sign in with Microsoft”. Xol starts a temporary listener on
http://localhost(your own computer, a random free port) and openslogin.microsoftonline.comin your default browser. Xol does not embed a browser window, so your password manager, passkeys and two-factor prompts work as they do everywhere else, and you can check the address bar. - You sign in on Microsoft's page and approve the request. Microsoft shows you the application name and what it is asking for.
- Microsoft redirects your browser to the local listener with a one-time authorization code. Because of PKCE, that code is useless to anything other than the Xol process that started the sign-in. The listener closes immediately afterwards.
- Xol exchanges the code for tokens directly with Microsoft. Xol is a public client: there is no client secret in the app and no Xol server takes part in the exchange.
- Xbox Live and XSTS. The Microsoft token is exchanged at
user.auth.xboxlive.comand thenxsts.auth.xboxlive.comfor a token scoped to Minecraft Services (rp://api.minecraftservices.com/). - Minecraft Services. Xol calls
api.minecraftservices.comto obtain a Minecraft access token, checks that the account has the Minecraft: Java Edition entitlement, and reads the profile (username and UUID). If the account does not own the game, Xol stops here and says so. - Launch. The Minecraft access token is passed to the game process on your computer, exactly as the official launcher does, so you can join online-mode servers.
If your browser cannot be opened, Xol offers Microsoft's device-code flow instead: you visit microsoft.com/link on any device and enter a short code. The rest of the chain is identical.
What Xol asks Microsoft for
| Scope | Why |
|---|---|
XboxLive.signin | Required to obtain the Xbox Live token that Minecraft Services accepts. It is the only way any launcher can prove ownership of Minecraft: Java Edition. |
offline_access | Lets Xol refresh your session without asking you to sign in again each time you play. |
Xol does not request access to your email, contacts, files, profile photo or any other Microsoft data.
What Xol receives and where it is kept
| Item | Used for | Stored |
|---|---|---|
| Microsoft refresh token | Renewing your session | On your device, sealed by the OS secure store |
| Xbox Live / XSTS tokens | One step in the chain | Not stored; discarded after use |
| Minecraft access token | Launching the game, joining servers | On your device, sealed; expires within a day |
| Username and UUID | Showing which account is active | On your device |
“Sealed by the OS secure store” means Keychain on macOS and DPAPI on Windows. If no secure store is available, Xol refuses to save the sign-in rather than writing tokens to disk in plain text.
None of these values is ever sent to Xol's servers, written to logs, or included in support files or crash reports. Support logs are redacted on your computer before you see them.
Removing access
- In Xol: open the account menu and choose Remove account. The stored tokens are deleted from your device.
- At Microsoft: visit account.microsoft.com/privacy/app-access and remove Xol. Any tokens Xol holds stop working.
Messages you might see
- “This account does not own Minecraft: Java Edition.” Sign in with the account that bought the game. Xol cannot launch without the entitlement.
- “This account has no Xbox profile.” Create one once at xbox.com with the same Microsoft account, then try again.
- “Child account” or “region not supported”. These come from Xbox Live. A child account must be added to a family group by an adult before it can sign in to third-party apps.
Questions
Write to hello@xol.dev. Security reports are welcome at the same address and are answered first.