Set up the client

Before you begin#

Have the public API URL, an approved Dicto release, and a provisioned account or SSO provider. Check API reachability from the user's network. Use the API base URL, such as https://api.dicto.example.com, without a trailing slash, query, fragment or /auth suffix.

Desktop installation#

Install the Windows, macOS or Linux release through your software distribution process. Download the app schema and configuration example. Place config.yaml beside the actual Dicto executable:

Paths depend on the installation. On macOS, Show Package Contents opens the application bundle. Include configuration through your managed installation process and verify the resulting signed app according to that process.

Minimal managed configuration:

# yaml-language-server: $schema=./app.schema.json
config_version: 1
server_config:
  api_url: https://api.dicto.example.com

Save app.schema.json beside the file for editor validation. Startup validation uses the schema embedded in Dicto, so distributing the schema beside the executable is optional.

Managed updates and telemetry#

For centrally controlled updates and disabled analytics/error reporting:

config_version: 1
server_config:
  api_url: https://api.dicto.example.com
app_updater:
  enabled: false
  check_automatically: false
analytics:
  enabled: false
sentry:
  enabled: false

Omitted settings inherit release defaults. Managed YAML takes precedence over compiled server defaults. Restart Dicto after changes. Incorrect types, unknown keys, unsupported values or invalid URLs stop startup rather than silently reverting to other settings.

Features and SSO#

Merge these sections into your configuration as needed:

feature_flags:
  scripto: enabled
  chat: hidden
  tools: disabled
authentication:
  sso_browser_mode: system
  allow_integrated_sso: true

enabled makes a feature available, hidden starts it off and permits a Developer Settings toggle, and disabled makes it unavailable. Server policies and service availability still apply. Desktop SSO uses the system browser by default. You can select integrated when allowed, or set allow_integrated_sso: false to enforce the system browser.

The app schema lists all supported keys. Use lowercase enum values and unquoted booleans. Omit optional settings rather than supplying null.

Web application containers#

Use the default GHCR images with :latest. Example clients.compose.yaml:

services:
  app:
    image: ghcr.io/truhnlab/dicto-app:latest
    restart: unless-stopped
    environment:
      BASE_HREF: /
  management:
    image: ghcr.io/truhnlab/dicto-management-app:latest
    restart: unless-stopped
    environment:
      API_URL: https://api.dicto.example.com
      BASE_HREF: /

docker compose -f clients.compose.yaml up -d

Both browser containers listen on port 80. Attach your HTTPS reverse proxy to the same Docker network and route the app hostname to app:80 and the management hostname to management:80.

In the end-user web app, choose Custom server during onboarding and enter your public API URL. The selection is stored in the browser.

The management web app uses its runtime API_URL, unless overridden by a compiled API URL. That URL must be reachable by the user's browser; an internal container hostname is not a public API URL. Configure server trusted origins and auth callbacks for your actual browser hostnames.

Use a leading and trailing slash in BASE_HREF for a deployment below a URL path. Verify navigation, configuration loading and sign-in callbacks under that path.

The desktop config.yaml mechanism applies to installed desktop clients. Management browser runtime settings are served publicly, so never export database passwords, auth secrets or inference-provider credentials into client configuration.

Verify the installation#

1. Open Dicto and confirm it connects to your intended server.
2. Sign in with a provisioned account or your configured SSO flow.
3. Grant microphone permission. Desktop auto-paste may require additional platform permissions.
4. Select or create a workspace as permitted by your account.
5. Record a short sample, stop recording, and confirm transcription completes.
6. Restart and verify that the connection and sign-in flow still work.

Use troubleshooting for configuration, connection or transcription failures.