Desktop
Supported platforms
The EON Path desktop client is a GUI application (Wails: Go backend, web frontend) built on the same Go core used by the mobile apps. It supports:
| Platform | Architecture |
|---|---|
| macOS | Apple Silicon (arm64) and Intel (x86_64), macOS 10.15+ |
| Windows | x86_64, Windows 10+ |
| Linux | x86_64 and arm64 |
Install
Install the desktop client build for your platform that comes with your EON Path licence. The routing method needs administrator rights on the machine, see below.
Connection methods and privileges
The client offers two kinds of endpoint, and the difference matters on a desktop:
| Method | What it does | Privileges |
|---|---|---|
| proxy | HTTP CONNECT tunnel plus SSH port forwarding | none |
| routing | full WireGuard tunnel with OS routes installed | root on Linux/macOS, Administrator on Windows |
The client checks whether it can install routes on this machine and leaves routing endpoints out of the list when it can’t. Run the client with the privileges above to use a routing endpoint.
First connection
When you open the client for the first time, add the server you want to
connect to by its address — a DNS name (for example vpn.example.com) or
IP address (for example 203.0.113.10).
On the first connection to a new server, the client performs the ML-DSA-87 post-quantum key exchange and then verifies the server’s identity before establishing the tunnel. This identity check is mandatory: the client will not connect to a server whose identity it cannot verify, using either a pinned identity hash configured for that endpoint or a DNS TXT record. See Server identity pinning for how this works, and Configuration for how to set up an endpoint’s identity pin or DNS TXT record.
Once the server’s identity is verified, the client brings up a WireGuard tunnel keyed from the post-quantum exchange, and traffic is routed through it.