get-started
Kutrion Hub
The Kutrion Hub is the desktop account app: one place to sign in and manage your account, and the sign-in the other desktop apps and the CLI borrow with a one-time code, never a token.
Updated Oct 17, 2026
The Kutrion Hub is the Kutrion desktop app for macOS, Windows and Linux. It is the account home: it shows who is signed in, on which organization and server, and opens the account screens (profile, two-factor authentication, active devices, auto-lock, AI and privacy settings, and for organization admins billing and organization settings). The screens themselves are the web portal’s; the Hub does not reimplement them.
Its second job is to be the single place you sign in on a computer. The Kutrion Terminal and Transfer apps, the CLI and the browser extension can use the Hub’s sign-in instead of asking you for your password again.
Install
The Hub is the desktop app you download from Downloads (macOS, Windows or Linux). The builds are unsigned, so you allow them past your operating system on first launch; the Downloads card has the steps.
Kutrion Terminal and Kutrion Transfer, and the CLI when run interactively, check on first run whether the Hub is
present and start installing it if it is not. This is skipped when KT_NO_HUB=1 is set, on Linux with no display,
in CI, in a remote session, and where the build carries no installer script. Because those builds are unsigned, the
installer today accepts a package verified by its checksum over TLS from the update feed rather than by a
publisher signature.
Sign in once
There are two directions, and in both the password and your tokens never cross between apps.
- Hub to app. In Terminal or Transfer choose Sign in with Kutrion. The app asks the Hub on a local channel on this computer. The Hub answers with a one-time enrolment code that lasts 60 seconds and works once. The app redeems that code with the server over its own connection and gets its own session. If the Hub is not running or is signed out, the app tells you and you sign in directly.
- App to Hub. If you signed in to an app first, it can hand that sign-in to a signed-out Hub the same way, so the Hub does not need a second password entry. The Hub shows the account it was given and holds it until you press Continue; choosing Not you? revokes the new device instead.
The code is useless on its own. Redeeming it also needs a signature from a key the Hub holds, so another program on the same computer that learns a code cannot use it. Nothing in the exchange is a password, an access token, a refresh token, a private key or vault data.
Comparing codes
The first time an app and the Hub meet, each shows a short code derived from the other’s key. Compare them on screen and confirm before the app trusts the Hub; if the Hub’s key later changes, the app refuses until you re-confirm. The server also vouches for the Hub’s key before the app issues anything.
Settings
The Hub has a setting that controls whether browser extensions may reach it. It is on by default. Turn it off if you do not want the extension to use the Hub’s sign-in.
Sign-in and devices
Each app that signs in this way gets its own device entry and session. Review and sign out devices under Active devices in the Hub. The Hub keeps its session across restarts only where the operating system offers a usable keychain.
Which apps use it
The Terminal and Transfer apps, the CLI and the browser extension use the Hub. The Kutrion API (Relay) client keeps its own session and signs in through the browser; see Kutrion API.