Skip to content

Sign-in and accounts

Xol signs you in with Microsoft's standard flow for desktop applications: OAuth 2.0 authorization code with PKCE, in your system browser. You type your password into Microsoft's website, in your own browser. Xol never sees it.

Current status

Waiting for Mojang's approval

Every third-party launcher's application ID has to be approved by Mojang before Minecraft Services will accept it. Xol's has been submitted and is awaiting review. Until it is approved, sign-in runs through Microsoft and Xbox Live and then stops at the Minecraft Services step with:

Minecraft services rejected this launcher's application ID. The app registration must be approved by Mojang

under the title "Sign-in did not complete". This is expected for now. It is not a problem with your account, and there is nothing you can do on your side. The sign-in chain has been implemented and reviewed but has never been exercised against a real account, for the same reason.

Step by step

  1. You press "Sign in with Microsoft". Xol starts a temporary listener on http://localhost (your own computer, a random free port) and opens login.microsoftonline.com in your default browser. Xol does not embed a browser window, so your password manager, passkeys and two-factor prompts work as they do everywhere else, and you can check the address bar.
  2. You sign in on Microsoft's page and approve the request. Microsoft shows you the application name and what it is asking for.
  3. Microsoft redirects your browser to the local listener with a one-time authorization code. Because of PKCE, that code is useless to anything other than the Xol process that started the sign-in. The listener closes immediately afterwards.
  4. Xol exchanges the code for tokens directly with Microsoft. Xol is a public client: there is no client secret in the app and no Xol server takes part in the exchange.
  5. Xbox Live and XSTS. The Microsoft token is exchanged at user.auth.xboxlive.com and then xsts.auth.xboxlive.com for a token scoped to Minecraft Services (rp://api.minecraftservices.com/).
  6. Minecraft Services. Xol calls api.minecraftservices.com to obtain a Minecraft access token, checks that the account has the Minecraft: Java Edition entitlement, and reads the profile (username and UUID). If the account does not own the game, Xol stops here and says so.
  7. Launch. The Minecraft access token is passed to the game process on your computer, exactly as the official launcher does, so you can join online-mode servers.

Microsoft's device-code flow, where you visit microsoft.com/link on any device and enter a short code, is implemented in Xol's core as a fallback for machines where the browser redirect is not possible. The rest of the chain is identical. The launcher's interface does not offer it yet; it always uses the browser flow above.

The browser step times out after five minutes ("Sign-in timed out. Try again."). Only one sign-in can be in progress at a time.

What Xol asks Microsoft for

Scope Why
XboxLive.signin Required to obtain the Xbox Live token that Minecraft Services accepts. It is the only way any launcher can prove ownership of Minecraft: Java Edition.
offline_access Lets Xol refresh your session without asking you to sign in again each time you play.

Nothing else. Xol does not request access to your email, contacts, files, profile photo or any other Microsoft data.

What Xol receives and where it is kept

Item Used for Stored
Microsoft refresh token Renewing your session On your device, sealed by the OS secure store
Xbox Live and XSTS tokens One step in the chain Not stored; discarded after use
Minecraft access token Launching the game, joining servers On your device, sealed; expires within a day
Username and UUID Showing which account is active On your device

"Sealed by the OS secure store" means Keychain on macOS and DPAPI on Windows. If no secure store is available, Xol refuses to save the sign-in rather than writing tokens to disk in plain text.

None of these values is ever sent to Xol's servers, written to logs, or included in support files or crash reports. The launcher keeps tokens in its main process only; they are never passed to the interface. The game's output is scrubbed of the access token before it reaches the log Xol keeps, and launch arguments are redacted.

Refreshing

When the saved Minecraft session is within ten minutes of expiring, Xol renews it before launching, using the refresh token, without opening the browser. The renewed session must belong to the same player as the saved account; otherwise it is refused with "the refreshed session belongs to a different player; sign in again".

Several accounts

You can sign in more than one account and switch between them in the account menu. One is active at a time. Switching is disabled while a game is being prepared or is running.

Removing access

  • In Xol: open the account menu, press the bin icon next to the account, and choose Remove. "The saved sign-in is deleted from this computer."
  • At Microsoft: visit account.microsoft.com/privacy/app-access and remove Xol. Any tokens Xol holds stop working.

Every sign-in message

Message Meaning What to do
Minecraft services rejected this launcher's application ID. The app registration must be approved by Mojang Mojang has not approved Xol's application ID yet Nothing on your side. See Current status.
Microsoft sign-in is not configured: no application (client) ID. (title: "Sign-in is not available in this build") The build was packaged without an application ID Ask for a current build
This Microsoft account does not own Minecraft: Java Edition. The entitlement check failed Sign in with the account that bought the game. Xol cannot launch without the entitlement. The help button opens the Minecraft store page.
This account owns Minecraft but has not chosen a player name yet. Set one at minecraft.net, then sign in again. The game is owned but no profile exists Follow the help button to minecraft.net, choose a name, sign in again
This Microsoft account has no Xbox profile yet. Create one, then sign in again. Xbox Live error 2148916233 Create the profile once at xbox.com with the same Microsoft account, then try again
Xbox Live is not available in this account's country/region. Xbox Live error 2148916235 This comes from Xbox Live; Xol cannot work around it
This account needs adult verification on the Xbox website. Xbox Live errors 2148916236 and 2148916237 Complete the verification at xbox.com
This is a child account. An adult must add it to a Microsoft family before it can play. Xbox Live error 2148916238 An adult adds the account to a family group at account.microsoft.com/family. Microsoft's family settings decide whether a child account may sign in to third-party apps.
Xbox authorization failed (HTTP …). Another XSTS error Try again later
Xbox Live sign-in failed (HTTP …). The Xbox Live step failed Try again later
Minecraft sign-in failed (HTTP …). Minecraft Services answered with an unexpected error Try again later
Microsoft sign-in failed: … / Microsoft sign-in failed (HTTP …) Microsoft refused the code or token request. The text after the colon is Microsoft's own. Try again
Could not start sign-in: … The device-code flow could not be started (not reachable from the launcher's interface today) Try again
Sign-in response failed validation. The response that reached the local listener did not match the request Xol made Start the sign-in again from Xol
Sign-in timed out. Try again. / The sign-in code expired. Try again. The browser step was not finished in time Start again
Sign-in cancelled. You pressed Cancel
A sign-in is already in progress. Finish it in your browser, or cancel it first. Finish or cancel the first one
Secure credential storage is unavailable on this system, so Xol will not save a sign-in. On Linux, install and unlock a keyring (GNOME Keyring or KWallet). No OS secure store Xol refuses to store tokens in plain text. On Windows and macOS the store is part of the system.

Where an error has a help page, the panel has an Open help page button. It opens only addresses on the launcher's fixed list: Microsoft's sign-in and account pages, aka.ms, minecraft.net and xbox.com.

Microsoft's side

When you sign in, your computer talks directly to Microsoft, Xbox Live and Minecraft Services. Their handling of your data is covered by the Microsoft Privacy Statement. The public walkthrough of this flow is at launcher.xol.dev/sign-in.