EUZOSLogin: first boot, login screen, offline and company login
FAQ › EUZOS Desktop › Login · Nederlands
What is it?
When EUZOS Desktop has booted, it shows the login screen. Nothing of a user is stored on the PC in the clear: the profile comes from the profile server after you log in, lives only in RAM, and is wiped when you sign out ("fully online, nothing local"). You can log in in four ways:
- QR code with the EUZOS app on your phone (the phone chooses the profile, Work or school or Personal, and you confirm with fingerprint or Face ID);
- e-mail address and password (the same as in the EUZOS app);
- Sign in with Microsoft (your company's Entra ID work account, device code flow);
- offline sign-in with the password you last used on this PC, when there is no connection.
Which profile server the PC trusts is in \EOS\FW\PROFILE.TXT.
How do I…?
How do I get to the login screen after installing?
Boot from the internal disk (or the stick). When the network, Wi-Fi and sshd have started, the boot screen stops and screen::start_up shows the login screen, with the boot sound. Two things keep you in the console instead:
\EOS\FW\SCREEN.TXTcontains the wordconsole(see Screen lock › Config files);- there is no usable
PROFILE.TXT(profile::boot_check): no file, an unreadable file, or a file this PC cannot log in with. The console then printsScreen : console, because …. A production build needs no PROFILE.TXT (it has the production server built in).
Type screen login in the console to show the login screen anyway.
How do I log in with my phone?
Open the EUZOS app and scan the QR code. The app shows the same six-digit pairing code that is printed below the QR code; check that they match, choose the profile (Work or school / Personal) and confirm. While no phone has fetched the code, the QR code is replaced by a new one every 30 s (a photo of the screen is worthless after that); once a phone has fetched it, the screen shows "Confirm on your phone…" until you confirm or refuse.
How do I log in with e-mail and password?
Type your e-mail address and password in the form to the right of the QR code and press Sign in (or Enter). The QR code keeps working meanwhile. In a test build you can log in to another environment by prefixing the address: sbx:<e-mail> or prod:<e-mail> (see Environments).
How do I create an account on the PC?
Press Create account below the form: first name, last name, place of residence, e-mail address and a password (at least 10 characters, twice). The profile server sends a 6-digit code by e-mail (valid 24 hours); type it on the PC, after which the PC logs you in. Send code again requests a new code. A QR code on that screen opens the registration web page (https://<server>/registreer) on your phone. If the server does not allow self-registration, the screen says "Ask the administrator".
How do I sign in with my Microsoft work account?
Press Sign in with Microsoft (only shown when the PC has an Entra app in \EOS\FW\MSAPP.TXT). The screen shows an address (microsoft.com/devicelogin), a code in large print and a QR code. Sign in on your phone or another computer; your organisation's MFA and Conditional Access apply. The PC then sends the ID token to the profile server, which logs you in with your business profile. Your organisation must be registered at the profile server (tenant and e-mail domain), otherwise you see "Your organisation does not use EUZOS yet". Mail and OneDrive then work right away with the same Microsoft sign-in. See Profile server › Organisations.
How do I log in without internet?
If you logged in with a password on this PC before (and the server's policy allows offline sign-in), the PC keeps an offline vault. Without a connection the login screen shows Offline sign-in next to the Choose Wi-Fi card: "No connection; sign in with the password you last used on this PC". With the right password your profile directory opens in offline mode, with the Offline label in the bar. As soon as there is internet again, the PC reconnects by itself (every 30 s) and the label disappears.
Limits: 3 free attempts, then a growing wait (30 s, 60 s, 120 s, … at most 15 min); after 10 errors the offline vault is erased. The vault expires after the number of days the server allows (default 14, at most 30, 0 = not allowed). Logging in with the QR code or Microsoft does not create an offline vault.
How do I sign out?
On the desktop: the power button › Sign out, then confirm "Sign out?". In the console, the terminal or over SSH: logout (no question). Signing out logs the token out at the profile server, wipes the profile and everything of the session from memory (browser data, mail, Chromium, Microsoft tokens, clipboard, terminal scrollback and shell history) and shows the login screen with a new code.
You are also signed out automatically when:
- you sign out this PC remotely from the EUZOS app;
- the PC has had no valid answer from the server for 15 minutes;
- you have been logged in for 12 hours (also offline).
How do I choose the language of the login screen?
Tap the Language card at the bottom and choose one of the 34 languages. It applies right away and the PC remembers it in \EOS\FW\LANG.TXT (written once nothing has been chosen for 2 s). That choice wins over language= in PROFILE.TXT. After login the profile's language applies.
How do I allow only business profiles on this PC?
profile private off writes private=off into PROFILE.TXT (legacy prive=uit is still read). The login screen then only offers "Work or school", the PC asks the server for voorkeur=zakelijk and refuses a personal profile that still comes in. profile private on reverses it.
How do I switch between SBX and PROD?
Only in a test build:
environmentshows the build, the default environment and the environment of the current session;environment sbx|prodwritesenvironment=into PROFILE.TXT (with the built-in server and key;private=andlanguage=stay); active after a reboot;profile sandbox|production|local [key]writes a fresh PROFILE.TXT for that environment; active from the next login code;- on the login screen,
sbx:<e-mail>orprod:<e-mail>logs in to that environment for one session.
An orange SANDBOX label shows on the login screen while the default is SBX, and in the bar while the session is SBX. A production build only knows PROD and refuses these commands.
Why can't I open the console from the login screen?
In a production build the console (Ctrl+Alt+F1/T, screen console, the Console line in the power menu, the terminal), sshd, log and profile/environment are admin commands: they are only allowed with a signed policy in your profile (beheer=), set by the administrator on the profile server. Without a logged-in session a production build only accepts help, reboot, poweroff, screen login, screen back, and battery, date, mem without arguments. A test build allows everything unless a signed policy says otherwise. See Console.
How do I register this PC with a device key?
pckey create makes an Ed25519 device key in \EOS\FW\PCKEY.TXT (only with strong randomness, never overwritten). pckey shows the public key, its fingerprint and the CLI line the administrator runs on the profile server (pc-register '<name>' <key> <organization>). The key is used by Server Admin to sign commands to a workplace server; the installer never copies it.
Details
The QR login (session poll)
- Per login code the PC makes a
LoginAttempt: a session idS(in the QR codehttps://<server>/l/<S>) and a PC secretG(128 bits, only in RAM, never on screen or in the log). The six-digit pairing code is computed fromSandSHA-256(G)with the domainEUZOS-koppelcode-v1. - Thread
login(profile::wait_for_phone) polls every 2 sGET https://<server>/api/sessie/<S>?pc=<G>[&voorkeur=…]; the first poll creates the session on the server. As long as no phone has fetched the code, after 30 s (euzos_profile::QR_MS) the PC polls with&intrekken=1and shows a new code. - On
okthe response is checked byeuzos_profile::parse_response: version 2, the Ed25519 signature (handtekening=, overEUZOS-profiel-v2\0+ everything before it) with the key from PROFILE.TXT, andomgeving,server,sessie,pcequal to the PC's own values,verlooptin the future (when the clock comes from NTP). Otherwise the response is wiped and a new code comes. profile::loginremembers server and token, starts the status thread and hands the profile todesktop::start.
After login
- Status: thread
statusasksGET /api/status?token=…every 30 s.afgemeld(remote logout or expired) wipes the profile and shows the login screen. No valid answer for 15 min, or 12 h logged in: logout. - Settings write-back: what you change (bar, theme, language, colour, keyboard, touchpad, screensaver, recent apps, browser favourites, …) goes 2 s after the last change in one
POST /api/profiel/instellingen?token=…. On failure (no network, 429, 5xx) it is retried after the next valid status reply; logout sends what is still pending first. Only the names of the settings go into the log, never the values. - Admin policy:
environment::set_policytakesbeheer=from the signed profile (in a production build only from a PROD profile signed with the built-in production key). It is cleared on every logout path.
Offline sign-in
- After a successful password login, thread
login-pwderives a key from the password (Argon2id, 64 MiB, t=4, own salt;offline::after_login). When the profile directory is open, the vault goes to partition 2 (euzos_profiledir::offline, max. 8 per PC) and the signed profile tosysteem/offline/profielin the directory. - Without a connection (
offline::try_login, only on a network error, never on an error answer from the server) the vault, the directory and the profile open; the server's signature is checked again. The session has no PC token: no vault, DriverEnricher, BrowserFeedback or app catalogue. - Thread
reconnect(every 30 s) posts the reconnect token; 200 makes the session online (profile::came_online), 403 (revoked, blocked, deleted, expired, off, unknown) erases the vault and signs out. - Settings changed offline that could not be sent are saved in
systeem/offline/instellingen-<n>and sent by the next online session.
Microsoft (Entra) login
kernel/src/entra.rs: thread entra requests a device code (RFC 8628) with the client id from MSAPP.TXT, scopes openid profile email plus those of mail and OneDrive. After confirmation the ID token goes to POST /api/pc/entra (profile::entra_request) with its own session id and PC secret; the server answers with a signed profile (methode=microsoft), always the business profile. entra::take_token then turns the Microsoft token into an account of crate::microsoft (mail, OneDrive). Tokens and codes stay in RAM.
Login screen layout
libs/ui/src/login.rs: logo top left; "SIGN IN" with the QR column on the left and the form (e-mail, password, Sign in) on the right, with "or" between them (in portrait stacked); below the form Create account and Sign in with Microsoft. At the bottom a row of cards:
| Card | Shows | Tap |
|---|---|---|
| Network | cable or Wi-Fi with name and strength | the Wi-Fi panel |
| Mobile (only with a modem) | provider, generation, signal, or "PIN required", "No SIM card" | the Mobile network panel (PIN field) |
| Language | globe and language name | the language panel |
| Battery (only with a battery) | percentage and charging state | — |
| Time | time and date | — |
| Power | icon | Restart, Shut down, Console (Console not in a production build) |
Without network or profile server there is no QR code but an explanation and Choose Wi-Fi.
Reference
Console commands
| Command | Arguments | What it does |
|---|---|---|
screen login | — (legacy alias scherm inlog) | the login screen with a new login code |
screen off | — (legacy uit) | back to the console; a logged-in profile is signed out and wiped |
screen desktop | [business|private] [<language code>] (legacy zakelijk, prive, privé) | the desktop with a sample profile, without logging in; refused when someone is logged in |
logout | — (legacy aliases afmelden, uitloggen) | sign out: token out at the server, profile wiped, login screen |
profile | — (legacy alias profiel) | show environment, server, key (hex and key id), private on/off, whether login is possible, the server of the session |
profile sandbox | — | write PROFILE.TXT for the sandbox server with the built-in sandbox key (test build) |
profile production | — (legacy productie) | write PROFILE.TXT for the production server (test build) |
profile local | [key] (legacy lokaal) | PROFILE.TXT for a local development server; key = 64 hex from euzos-profielserver key; the TLS root comes from \EOS\FW\EXTRA.PEM |
profile private | off|on (legacy prive, privé; uit, aan) | set or remove private=off |
environment | — (legacy alias omgeving) | show build, default environment and session environment |
environment | sbx|sandbox|prod|production (legacy productie) | set environment= in PROFILE.TXT; after a reboot (test build only) |
offline | — | the offline vaults on this PC (days left, errors, Argon2id parameters; no addresses) and whether the session is offline |
offline wipe | — (legacy wis) | erase all offline vaults on this PC |
pckey | — (legacy alias pcsleutel) | show the device key, fingerprint and the pc-register line |
pckey create | — (legacy maak) | create \EOS\FW\PCKEY.TXT (refused if it exists or without RDRAND) |
All other screen subcommands (console, back, welcome, theme, lock, photo, test-build helpers) are on Screen lock › Console commands.
profile, environment, log, sshd and showing the console are admin commands (euzos_profile::console::Admin), see Console.
Functions and modules
| Function / module | Role |
|---|---|
kernel::profile::config / config_for / active_config | PROFILE.TXT of this boot; config for an environment; config of the logged-in session |
kernel::profile::boot_check | is there a usable PROFILE.TXT (decides login screen vs console) |
kernel::profile::command, environment_command | the profile and environment commands |
kernel::profile::LoginAttempt (qr, pairing_code) | one login code: session id, PC secret, pairing code |
kernel::profile::wait_for_phone | thread login: polls the session |
kernel::profile::login, login_offline, came_online, end_offline | start an online/offline session, go online, end offline |
kernel::profile::login_with_password, password_login | password login from the login screen / the installer |
kernel::profile::register, confirm, resend_request, registration_qr | create an account on the PC |
kernel::profile::entra_request | ID token to the profile server |
kernel::profile::logout, session_logout, clear_user, logout_at_server | sign out and wipe everything of the user |
kernel::profile::setting_changed, recent_changed, favorites_changed, sites_changed, mail_accounts_changed | queue settings for write-back |
kernel::profile::unlock_check | password check for the lock screen |
kernel::offline::{after_login, try_login, follow, check, command} | offline vault: create, log in, reconnect, unlock check, console |
kernel::entra::{start, take_token} | Microsoft device code flow |
kernel::device_key::{command, public_key, sign_command} | the PC's device key |
kernel::environment::{PRODUCTION, set_policy, clear_policy, admin_allowed, shell_allowed} | build type and admin policy |
kernel::lang::{pc, current, set_pc, set_session, choice} | language of the PC and of the session; LANG.TXT |
kernel::screen::{start_up, login_show} | show the login screen at boot / on demand |
euzos_profile::Config::parse | parse PROFILE.TXT |
euzos_profile::parse_response, parse_status | check the session and status answers |
euzos_profile::pairing_code | six-digit pairing code |
euzos_profile::writeback::{KEYS, valid, Changes, parse_response} | settings write-back allowlist and request |
euzos_profile::console::{Admin, Policy, allowed, line_allowed, allowed_without_session, policy_for_build} | console and admin rules |
euzos_profiledir::offline | the offline vault table on partition 2 |
euzos_oauth::MsApp | parse MSAPP.TXT |
euzos_ui::login | drawing the login screen and its cards |
Config files
Since 27-10-2026 EUZOS writes English config file names, keys, values and confirmation words (for example
WIPE-…,environment=inPROFILE.TXT); the old Dutch names (marked legacy here) are still read and accepted (docs/ENGLISH.md).
| File | Key | Values | Meaning |
|---|---|---|---|
\EOS\FW\PROFILE.TXT (legacy name PROFIEL.TXT, still read) | environment (legacy omgeving) | local, sandbox, production (legacy lokaal, productie) | environment (required) |
server | host or host:port | profile server (default: built-in for the environment) | |
key (legacy sleutel) | 64 hex | the server's public Ed25519 key | |
key-id (legacy sleutel-id) | 16 hex | must match the key (typo check) | |
private (legacy prive) | on, off (legacy aan, uit) | off: only Work or school | |
language (legacy taal) | language code | language of the PC (login and boot screen) | |
| (other keys) | — | skipped; a key twice is an error (a Dutch key and its English one count as the same key) | |
\EOS\FW\LANG.TXT (legacy TAAL.TXT) | language (legacy taal) | one of the 34 codes | language chosen on the login screen; wins over language= in PROFILE.TXT |
\EOS\FW\MSAPP.TXT | client_id | GUID (required) | Entra app for Sign in with Microsoft |
tenant | common (default), organizations, consumers, tenant id/domain | which accounts may sign in; unknown keys are an error | |
\EOS\FW\PCKEY.TXT | (one line) | 64 hex | Ed25519 seed of the device key |
\EOS\FW\SCREEN.TXT (legacy SCHERM.TXT) | first word | console; login/inlog/graphical/grafisch or empty | console: no boot screen and no login screen |
\EOS\FW\EXTRA.PEM | — | PEM | own TLS root for profile local (ignored in a production build) |
In a production build only private= and language= from PROFILE.TXT count; server and key are built in (Config::production_only).
API endpoints (called by the PC)
The kernel still calls the legacy Dutch routes; the English routes are live next to them on the server with byte-identical bodies. Full details: Profile server › API.
| Method | Path the kernel uses (legacy) | English route | Purpose |
|---|---|---|---|
| GET | /api/sessie/<S>?pc=<G>[&voorkeur=…][&intrekken=1] | /api/session/{id} | poll the QR login |
| GET | /api/status?token=… | /api/status | is the session still valid |
| GET | /api/afmelden?token=… | /api/logout | log the PC token out |
| POST | /api/pc/inloggen | /api/pc/login | password login (also the lock screen) |
| POST | /api/pc/entra | /api/pc/entra | Microsoft ID token login |
| POST | /api/pc/herverbind | /api/pc/reconnect | offline session back online |
| POST | /api/pc/registreer | /api/pc/register | create an account |
| POST | /api/pc/verifieer | /api/pc/verify | confirm the e-mail code |
| POST | /api/pc/opnieuw | /api/pc/resend | new e-mail code |
| POST | /api/profiel/instellingen?token=… | /api/profile/settings | settings write-back |
Page URLs: https://<server>/l/<S> (QR code), https://<server>/registreer (registration QR).
Protocol messages and formats
Session poll answer (first line, then key=value lines):
| First line | Lines | Meaning |
|---|---|---|
wacht | code=<6 digits>, gezien=1 | not approved yet (gezien=1: a phone fetched the code) |
verlopen | reden=… | too late, refused, revoked or used: new code |
ok | versie=2, omgeving, server, sessie, pc, verloopt, profile lines, token=, handtekening= (last) | the signed profile |
Profile lines (signed, Dutch keys on the wire): soort=zakelijk|prive, naam, weergavenaam, kleur, taal, item= (files), recent=, settings keys (below), beheer= (admin policy, signed only), beleid-scherm= (screen policy, signed only), and after a password login offline-dagen=, offline-token=, account=.
Settings write-back keys (euzos_profile::writeback::KEYS): kleur, taal, balk (boven|onder), balk-verbergen, taskbar-hide-maximized (on|off), welkom, schermtoetsenbord (automatisch|altijd|nooit), toetsenbord (layout), toetsenbord-tik, thema (donker|licht|automatisch), touchpad-natuurlijk, touchpad-tikken, touchpad-rechtsklik, touchpad-snelheid, touchpad-aanwijzer, muis-snelheid, muis-omwisselen, muis-wiel-omkeren, pointer-size, pointer-hide, aanraak-vegen, aanraak-doorrollen, aanraak-lang-drukken, screensaver, screensaver-wachttijd, screensaver-animatie, vergrendelen, recent, browser-zoekmachine, browser-favoriet, browser-engine, browser-site, mail-account. On/off values are aan|uit.
Write-back answer (writeback::parse_response): 200 ok = saved; 401 = token gone; 400/413 = rejected (reason on line 2); 404 = server too old; otherwise retry.
Status answer: ok (with verloopt=) or afgemeld (with reden=).
Admin policy line: beheer=console,sshd,log,profiel (any subset; lokaal counts as profiel; empty or geen = nothing).
Signed constants: EUZOS-profiel-v2\0 (profile signature domain), EUZOS-koppelcode-v1\0 (pairing code).
See also
- docs/PROFILE-PROTOCOL.md
- docs/OFFLINE-LOGIN.md
- docs/WORK-LOGIN.md
- docs/ENVIRONMENTS.md
- docs/DESKTOP-DESIGN.md (1. Login, 5. Console and admin)
- docs/LANGUAGES.md
- FAQ: Installer, Desktop and apps, Screen lock, Storage, Profile server › PC login