The account server is QuickDesk’s HTTPS control plane. It handles everything that is not the live desktop stream. Clients ship with a default server. A single client setting points them at your own deployment for a fully in-house remote-access product.
The account server carries no pixels. The desktop session is encrypted end to end over the QUIC relay. The account server handles identity, the address book, device state, and the audit / recording trail.

​
What the account server does

Login & SSO

Password login plus OIDC single sign-on. A QuickDesk session is an ordinary session from your identity provider. The client holds a short-lived bearer token, not your credentials.

Address book

A personal, per-user directory of devices and tags. Operators reconnect by name instead of by id.

Device registry

Devices register on boot with a heartbeat and system info. The registry tracks which devices are online. An operator can disconnect a device.

Audit & recording

A log of connection sessions and file transfers, plus optional server-side session recording for compliance.

​
API surface

The server implements the surface that the clients call directly: bearer-authenticated JSON over HTTPS.
The device heartbeat, sysinfo, and audit routes are intentionally token-less. A box registers and reports before any user signs in on it. These routes are keyed by device id. The account server’s device gate secures them.

​
Backing services (by role)

The server is stateless. Supply one of each of these standard roles. None is QuickDesk-specific. Use the services that you already run:

​
Deploy

1

Provision the backing roles

Start the identity, database, object storage, analytics store, and cache roles, or point at existing ones. Load the QuickDesk schema into the database and the analytics store.
2

Configure the server

Set the connection details for each backing role. Set your identity provider’s issuer. Set the object-storage endpoint and bucket for recordings.
3

Put it behind TLS on a stable host

Terminate HTTPS on a hostname that your clients will use as their account server, for example a dedicated admin subdomain. Allow a large request body on /api/record (recordings upload in chunks). Disable request buffering on that route.
4

Repoint the clients

Set the clients’ account server to your host. Preset it in a managed fleet, or set it per machine. New sessions then authenticate, audit, and record against your deployment.

​
Single sign-on

QuickDesk uses a poll-based login flow. The server bridges the flow onto a standard OIDC redirect provider. Thus the native client does no fragment handling.
1

Enable a provider on your identity server

Turn on an external OIDC provider. Add your account server’s callback URL to the provider’s redirect allow-list.
2

Client starts auth

The client calls /api/oidc/auth. The server mints a correlation id, stores a PKCE verifier, and returns the provider authorize URL.
3

Provider redirects back, client polls

After the user signs in, the provider redirects to /api/oidc/callback. The server exchanges the code and stores the session. The client polls /api/oidc/auth-query with the correlation id and receives its bearer token.
You manage providers on your identity server, not in QuickDesk. When you enable or disable a provider, /api/login-options shows the change with no client or server redeploy.