Signing in and session lifetime: keychain, heartbeat, offline grace

The Senzoukria desktop app is unlocked with the email and password of the web account. The session token lives 15 minutes and is renewed by a heartbeat every 5 minutes; after 30 minutes without a successful renewal the app signs out.

Senzoukria · Documentation · Updated September 2026

Where to find it

Where
Sz menu → Account; every protected route redirects there when no session exists
Credentials
"Save my credentials (OS keychain)" is checked by default; the password goes to the OS credential store, never to a file
Token
15-minute lifetime, heartbeat every 5 minutes, retry every 60 s, sign-out after 30 minutes without renewal

What it does

The sign-in form asks for Email and Password and shows the note: "The app stays locked until you sign in. Use the email and password of your Senzoukria web account — signing in on the website does not unlock the desktop app." On the very first launch, before any session exists, a welcome card offers "Sign up on the web" and "I already have an account".

When credentials are saved, the form is pre-filled from the keychain and submitted once automatically at the first mount of the process. After a Sign out the form is pre-filled again but waits for a click, so signing out is not undone by the auto-login. A failed auto-login keeps the saved credentials: one network blip must not erase a remembered login.

Session lifecycle

Timings and rules read from the heartbeat code
RuleValueEffect
Token lifetime15 minutesThe server JWT expires; renewal is the heartbeat's job
Heartbeat interval5 minutesRenews the token and re-checks licence, subscription and machine
Retry after a temporary failure60 secondsNetwork errors, 429 or 503 are retried; they never reset the grace clock
Maximum without a renewal30 minutesBeyond it the app signs out locally
Definitive refusalHTTP 4xx except 408, 425, 429Immediate sign-out; no password re-login is attempted, so a revoked machine is not recreated
Wake-upWindow focus, online event, tab visibleTriggers a due heartbeat without adding requests when the session is fresh
Refresh buttonAccount pageRuns one heartbeat by hand: "Renew the session token via heartbeat"

How to use it

Enter the web account email and password and keep the checkbox on if this is your machine. The link "Forgot password? Signed up with Google?" opens the website: a Google account has no password until one is set there, and the app cannot sign in with Google directly.

Sign out from the Account page ends the session but keeps the keychain entry; untick the checkbox at the next sign-in to clear it. The feedback line reads "Logged out — sign in below to restore access."

Limits or pitfalls

Error messages and what they mean:

  • "Invalid email or password." — INVALID_CREDENTIALS from the server.
  • "This account signs in with Google. Use « Forgot password? » below to set a password, then sign in here."
  • "A PRO subscription is required to use the desktop app." and "Your subscription has expired." — the licence is checked at sign-in and at every heartbeat.
  • "This license is already in use on the maximum number of machines." — free a slot from the website's devices page.
  • "Account temporarily locked. Try again in a few minutes." — after repeated failures.
  • A network error keeps the same password valid; the message says not to reset it.
  • If the keychain write fails, the app still signs you in and shows the real error instead of pretending the credentials were saved.

This page in other languages

Frequently asked questions

Why was I signed out after working offline?
The session needs one successful heartbeat every 30 minutes. Without network for longer than that the app signs out locally; sign in again once online.
Does the app store my password in a file?
No. With "Save my credentials" on, the password goes to the OS keychain (Credential Manager, Keychain or Secret Service). Session tokens are handled by the Rust side.
I signed in on senzoukria.com. Why is the desktop app still locked?
The website session and the desktop session are separate. Use the same email and password in the app's sign-in form.

Keep reading

Strategy researchTest a trading strategy, from observation to challenge rulesDefine an observation, question it with the copilot, write a rule and explore costs, drawdown and fictional challenge limits in an interactive example.Quant · Start hereQuant trading for beginners: from idea to backtestDefine a testable rule, choose suitable data and evaluate later periods after costs.Order flow · HubOrder flow trading: the complete guideThe hub. What order flow is, what it shows — aggression, delta, imbalance, absorption, liquidity — and the tools that read it, each linked to a full guide.