The webview navigates to http://127.0.0.1:18901/oidc/open?apiUrl=... The Go server opens the system browser to Authentik, waits for callback, exchanges code for token, saves to keychain, then redirects the webview back with ?desktop=1&token=TOKEN. main.ts extracts the token from URL.