# Set up the client

Connect managed workstations and browser applications to your Dicto server.

## Before you begin

Have the public API URL, an approved Dicto release, and a provisioned account or SSO provider. Check API reachability from the user's network. Use the API base URL, such as `https://api.dicto.example.com`, without a trailing slash, query, fragment or `/auth` suffix.

## Desktop installation

Install the Windows, macOS or Linux release through your software distribution process. Download the [app schema](/schemas/app.schema.json) and [configuration example](/examples/config.example.yaml). Place `config.yaml` beside the actual Dicto executable:

| Platform | Typical location |
| --- | --- |
| Windows | `C:\Program Files\Dicto\config.yaml`, beside `Dicto.exe` |
| macOS | `/Applications/Dicto.app/Contents/MacOS/config.yaml` |
| Linux | `/opt/dicto/config.yaml`, beside the Dicto binary |

Paths depend on the installation. On macOS, **Show Package Contents** opens the application bundle. Include configuration through your managed installation process and verify the resulting signed app according to that process.

Minimal managed configuration:

```yaml
# yaml-language-server: $schema=./app.schema.json
config_version: 1
server_config:
  api_url: https://api.dicto.example.com
```

Save `app.schema.json` beside the file for editor validation. Startup validation uses the schema embedded in Dicto, so distributing the schema beside the executable is optional.

## Managed updates and telemetry

For centrally controlled updates and disabled analytics/error reporting:

```yaml
config_version: 1
server_config:
  api_url: https://api.dicto.example.com
app_updater:
  enabled: false
  check_automatically: false
analytics:
  enabled: false
sentry:
  enabled: false
```

Omitted settings inherit release defaults. Managed YAML takes precedence over compiled server defaults. Restart Dicto after changes. Incorrect types, unknown keys, unsupported values or invalid URLs stop startup rather than silently reverting to other settings.

> Info
`config.json` is no longer supported. Follow the [YAML migration instructions](/configuration.md#migrate-from-configjson) before rolling out this release.


## Features and SSO

Merge these sections into your configuration as needed:

```yaml
feature_flags:
  scripto: enabled
  chat: hidden
  tools: disabled
authentication:
  sso_browser_mode: system
  allow_integrated_sso: true
```

`enabled` makes a feature available, `hidden` starts it off and permits a Developer Settings toggle, and `disabled` makes it unavailable. Server policies and service availability still apply. Desktop SSO uses the system browser by default. You can select `integrated` when allowed, or set `allow_integrated_sso: false` to enforce the system browser.

The [app schema](/schemas/app.schema.json) lists all supported keys. Use lowercase enum values and unquoted booleans. Omit optional settings rather than supplying `null`.

## Web application containers

The management app has its own [deployment guide](/components/management.md),
including public API configuration, path prefixes and auth callbacks. The
[reference setup](/install/reference.md) pins its image and configuration.

For the end-user web app, deploy your approved `ghcr.io/truhnlab/dicto-app`
release behind HTTPS, route to its container port 80, and use `BASE_HREF=/` for
its own hostname (or the actual slash-terminated path prefix). Choose **Custom
server** during onboarding and enter the public API URL. The selection is stored
in the browser. Add that browser origin and its actual auth callback to the
server configuration and verify sign-in and a nested-page reload.

Desktop `config.yaml` does not configure management browser runtime settings.
Keep credentials and provider keys out of both public browser applications.

## Verify the installation

1. Open Dicto and confirm it connects to your intended server.
2. Sign in with a provisioned account or your configured SSO flow.
3. Grant microphone permission. Desktop auto-paste may require additional platform permissions.
4. Select or create a workspace as permitted by your account.
5. Record a short sample, stop recording, and confirm transcription completes.
6. Restart and verify that the connection and sign-in flow still work.

Use [troubleshooting](/operations/troubleshooting.md) for configuration, connection or transcription failures.