Account and online services

An account connects the complete desktop product to selected website services. Capture, Selector, the canonical project and local processing remain available without signing in; the sections below identify only operations that actually need a backend or external provider.

Where the boundary is

Path	Account	Data transfer
Local work Capture, Selector, project, classical CV, local Vosk/LLM	Not required for the core authoring workflow	Projects and local sources stay on the computer; an explicitly configured stream URL is read from that endpoint
Screph services Profile, balance, support, server speech and diagnostics upload	Authentication required	Support, speech and diagnostics transfer data for the selected operation; with a stored token, profile/balance refresh automatically
Screph infrastructure Update checks, embedded-help cache and runtime packs	Not required	Standard request metadata; the update check reports the app version and help refresh uses its own User-Agent. Projects and frames are not sent
Third-party providers Cloud LLM and speech using their own credentials	Depends on the provider	Context or audio is sent to the selected provider; opening Speech settings may also check its catalogue/connection
Model hosts Hugging Face, GitHub/Ultralytics, Alpha Cephei	No Screph account required	CV/Vosk model files are downloaded explicitly; opening the Vosk list also fetches its catalogue. The host sees standard request metadata, not the canonical project

Selecting a cloud connection must not silently reroute a local workflow to another provider. If the provider, network or credentials are unavailable, the operation should fail visibly.

Automatic and download requests

Account session: the Account widget schedules its first refresh about 100 ms after its own initialization. When an access token is stored, the desktop then performs an authenticated GET /api/v1/profile/ every 30 seconds and skips concurrent requests. Failures introduce 60, 120 and 300-second backoffs; a 401 may start OAuth token refresh. The request sends the token and ordinary HTTP metadata, not the project or desktop password.
Update check: enabled by default in an installed build with the maintenance tool, scheduled about four seconds after startup and limited to once every 24 hours. Screph fetches a small Updates.xml from https://screph.com; the User-Agent is Screph/<version> update-check. Disable it in General settings with Automatically check for updates on startup.
Embedded help: the build contains an offline snapshot of six core documentation pages. About 1.2 seconds after launch, the app may request the complete fresh set from screph.com and replaces the cache only when all six pages succeed. The current guard permits another attempt one hour after the previous one; there is no separate settings toggle. Requests use ScrephDocs/1.0 and contain no project, frames or account data. Other guides open on the complete website.
ML runtime pack: the preflight button downloads only publication.json. A separate Download action obtains the archive and four sidecars, then verifies SHA, detached signature, trust chain and installer manifest. This is an explicit action, not a background installation.
CV models: selected weights are downloaded through a separate action via Ultralytics or from a pinned Hugging Face revision. The standard HTTPS request exposes the device IP/User-Agent to the model host, but does not send the project, markup or source frames.
Vosk: first opening the language or model list starts a background GET to https://alphacephei.com/vosk/models/model-list.json; the result is cached in-process for five minutes and an embedded list is used on failure. Downloading a selected speech or punctuation model ZIP requires a separate action.
OpenAI/LiteLLM Speech: activating the settings page starts a check even without pressing Check. For OpenAI with an available key, this is an authenticated GET /v1/models. For a configured non-OpenAI LiteLLM path, Screph performs a real transcription request with a generated probe.wav: 0.1 seconds of 16 kHz mono silence. No microphone recording or project enters the probe, but the operation may appear in provider logs or usage.
Stream URL: OpenCV/FFmpeg/GStreamer connects directly to the configured RTSP/HTTP/UDP endpoint. The URL is stored in shared Capture settings; avoid embedding a long-lived secret in it and protect the settings file.

Desktop telemetry: the production configuration contains a SCREPH_TELEMETRY flag, but the current runtime has no identified consumer, Sentry initialization or telemetry exporter. The flag alone does not send data; no automatic desktop telemetry upload is claimed here.

What a website account provides

Website profile: username, email, UI language and aggregate balance in minutes and 15-second units. Minute usage is hidden in the current desktop Account page, which shows identity, device-flow and connection status instead.
Support: a profile or guest conversation. While the desktop widget is visible, it fetches the thread immediately and then about every 20 seconds with small jitter; errors back off to at most five minutes and hiding the widget stops the timer. Fetch sends the account token or guest key. New text and images are uploaded only when a message is submitted.
Desktop connection: browser confirmation gives the app a short-lived scoped token, not the account password or a global API token.
Manual diagnostics: authenticated submission of a ZIP bundle up to 25 MB. The Logging page provides a manifest preview; the alternative startup prompt requires Yes but does not show that manifest—choose No and submit from Logging when inspection is required first.

How the desktop app connects to an account

The app requests a device code for a registered client and the profile scope.
Screph opens the confirmation page and shows a code such as XXXX-XXXX.
The user signs in in the browser and explicitly approves the device. The code is valid for 10 minutes.
The desktop app receives a signed, scoped, expiring token. An approved device code cannot be reused.

Do not approve someone else's code

Check the code, client and scope on the confirmation page. Entering the code authorizes that specific app to read the listed profile data.

Screph server speech recognition

The versioned POST /api/v1/inference/speech/ endpoint accepts an authenticated WAV file in the audio field. The current server provider is Yandex SpeechKit. The response contract is versioned as screph-speech-inference.v1.

Every request requires a unique Idempotency-Key; safely replaying the same request does not debit the balance twice.
Usage is calculated in 15-second units, rounding duration up.
With insufficient balance, the provider is not called. A provider failure after debit triggers compensation; a replay returns the stored operation result.
If the server provider is not configured, a visible error is returned and no balance is debited.

This is a distinct online path. Local Vosk and bring-your-own-key connections are documented in the speech and LLM guide.

Local HTTP is not an internet transfer

Some desktop components use 127.0.0.1, so a firewall or network monitor may show a local listener. Monaco serves its own assets on an ephemeral port only while the widget exists. The Codex bridge log accepts local POST records on another ephemeral port and stores them in the Screph log. These endpoints do not upload a project to Screph Cloud, but they trust processes on the same computer and are not a sandbox.

The legacy OAuth callback can also listen on 127.0.0.1:8443 with a fallback to 8765, but it is disabled in the current configuration: the published device flow opens a browser and does not need a local callback listener.

Process and loopback endpoint map →

Not published

A balance is not a promise of an available purchase

The website code contains a package ledger, payment backend and webhook verification, but the user-facing /payments/purchase/ page currently redirects to the homepage. Package purchase is therefore not a published user workflow: there is no current plan, price or checkout to rely on. The current desktop build may not show balance or purchase controls at all; if a component or older build exposes the purchase link, opening it does not change the disabled web route's status. Any future offer must be published with its terms.

Before sending data

Speech: the selected WAV recording and recognition parameters are sent; use a local provider for sensitive audio.
Diagnostics: the ZIP contains the selected crash session and top-level runtime logs; the project or autosave is not attached automatically, but its paths or names may occur in logs. The manifest does not display file contents.
Support: text/attachments reach the server on send; a visible desktop chat separately polls the thread with an account token or guest key.
Website: server-side request logging and IP lookup apply when public pages are visited; the privacy policy lists the exact fields.

See the privacy policy and diagnostics and recovery guide.