diff --git a/cmd/desktop/main.go b/cmd/desktop/main.go
index 3c09dd3..fb87686 100644
--- a/cmd/desktop/main.go
+++ b/cmd/desktop/main.go
@@ -558,20 +558,22 @@ func main() {
 
 	ws := loadWindowState()
 	width, height := 1400, 900
-	minWidth, minHeight := 1024, 700
+	if ws != nil {
+		width = ws.Width
+		height = ws.Height
+	}
 
 	window := app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Title:    "Oikos",
 		Width:    width,
 		Height:   height,
-		MinWidth: minWidth,
-		MinHeight: minHeight,
+		MinWidth: 1024,
+		MinHeight: 700,
 		URL:      "/?desktop=1",
 	})
 
 	if ws != nil {
 		window.SetPosition(ws.X, ws.Y)
-		window.SetSize(ws.Width, ws.Height)
 	} else {
 		window.Center()
 	}
diff --git a/web/src/lib/oidc.ts b/web/src/lib/oidc.ts
index 68d7f51..c7ade97 100644
--- a/web/src/lib/oidc.ts
+++ b/web/src/lib/oidc.ts
@@ -101,7 +101,14 @@ export async function startLogin(): Promise<void> {
     scope: 'openid profile email'
   })
 
-  location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
+  const authURL = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
+
+  if (isDesktop) {
+    window.open(authURL, '_blank', 'width=800,height=700')
+    throw new Error('Login opened in your browser. After authenticating, copy the token and paste it into the Token tab.')
+  }
+
+  location.href = authURL
 }
 
 export async function handleCallback(code: string, returnedState: string): Promise<boolean> {
diff --git a/web/src/pages/Config.svelte b/web/src/pages/Config.svelte
index 6959a48..1cbfb25 100644
--- a/web/src/pages/Config.svelte
+++ b/web/src/pages/Config.svelte
@@ -67,27 +67,7 @@
     error = ''
     oidcLoggingIn = true
     setConfig({ apiUrl: apiUrl.trim(), token: '' })
-
-    const isDesktop = new URLSearchParams(location.search).has('desktop')
-
-    if (isDesktop) {
-      try {
-        const resp = await fetch(`http://127.0.0.1:18901/oidc/login?apiUrl=${encodeURIComponent(apiUrl.trim())}`)
-        const data = await resp.json()
-        if (data.token) {
-          setConfig({ apiUrl: apiUrl.trim(), token: data.token })
-          initConfig({ apiUrl: apiUrl.trim(), token: data.token })
-          oidcLoggingIn = false
-          onConnected()
-          return
-        }
-        error = data.error || 'Login failed'
-      } catch (e: any) {
-        error = e.message || 'Could not reach OIDC service'
-      }
-      oidcLoggingIn = false
-      return
-    }
+    initConfig({ apiUrl: apiUrl.trim(), token: '' })
 
     try {
       await startLogin()