Connect the desktop app
Sign in to the ForgeCast app with your account, and manage the devices that are signed in.
The desktop app signs in with your ForgeCast account — the same one you use on this website — so your plan and overlay inventory follow you to the app.
Sign in to the app
Open the ForgeCast app and choose Sign in.
Your default browser opens a page titled Authorize ForgeCast Desktop?. If you aren't signed in to the website yet, you're asked to do that first (Google or Discord) and then returned to this page.
Check that the device name is your computer and that you just started this from the app, then click Authorize.
The page says Back to the ForgeCast app, and your browser may ask whether to open ForgeCast: allow it. The app comes to the front, finishes signing in and shows your name and plan. You can close the browser tab. (If nothing happens, press Open ForgeCast on the page.)
Only click Authorize if you started the sign-in from the ForgeCast app on your own computer a moment ago. If a link or someone else asks you to authorize something you didn't start, click Cancel and close the page.
What the app can do once signed in
The app can see your name, picture and plan, use your overlay inventory, and — on Pro and Ultimate — create and edit your own overlays. It cannot change your sign-in provider, delete your account, create API keys, or see other devices' tokens. Those actions are only available on the website.
How long you stay signed in
| Behind the scenes the app renews its access automatically | Every 15 minutes, silently |
| You stay signed in | Up to 90 days, then you sign in again |
| You can end any session sooner | Yes — see below |
Manage your devices
Every computer that has signed in appears on your account page under Connected desktop apps, with when it signed in and when it was last active.
To sign a device out remotely — for example a laptop you lost or a PC you sold — click Sign out device. It takes effect immediately: that app can't make another request, and has to sign in again.
You can also sign out from inside the app (Settings → Account → Sign out), which ends that device's session on the server too.
Security notes
These are the protections that make desktop sign-in safe. You don't need to do anything for them, but it's useful to know:
- The browser hands the app a one-time code that expires after 60 seconds and works only once. The app swaps it for its access tokens together with a secret that never left your computer (PKCE), so another program that glimpsed the code can't use it.
- The code is only ever sent back to your own computer, through the
forgecast://link that opens the ForgeCast app. The app only accepts it for a sign-in it started, and checks a secretstatevalue first. - The long-lived renewal token is kept in the Windows Credential Manager, never in a plain file.
- ForgeCast keeps only hashes of those secrets on its servers.
- If a renewal token is ever used twice — a sign it was copied — the whole session is revoked and the app asks you to sign in again.
Updates
The app checks for updates when it starts and every few hours while it is open. When one is found, a small notice appears at the bottom of the window and under Settings → Updates, where you can read what changed and install it. With Install updates automatically on (the default), the update is installed before the app opens, behind the loading screen. Every update is signed: the app refuses to install anything that doesn't match the key built into it, even if the download itself were tampered with. You can choose the stable or beta channel in the same place.
Troubleshooting
For developers
The sign-in flow is a standard OAuth 2.0 authorization-code flow with PKCE for native apps (RFC 8252). It is documented in full, with sample code, in Desktop app sign-in.