Settings
Behavior settings
Three settings that decide how much Frost is allowed to interrupt you, and how you interrupt it.
Authentication Mode
What Frost is allowed to do when a token expires while you are working.
Auto-open browser (default)
The login page opens as soon as the token needs replacing. With federated SSO — Google Workspace, Okta, Entra ID — your identity provider session usually satisfies the request without asking you anything, so most refreshes pass without you noticing. When it does ask, the page is already in front of you.
The cost is that a login page can appear while you are doing something else, roughly once a working day.
Notification + hotkey
Frost posts a system notification instead and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. Nothing appears on screen until you ask for it.
With Approve automatically on — the default — the notification moves to where it is worth having. Frost works through the approval off screen first, and only tells you when the sign-in turns out to need you: a password, a one-time code, a security key. A refresh your identity provider session covers passes in silence, with no notification and nothing to press.
The cost is that credentials stay expired until you act — commands fail
with ExpiredToken in the meantime — and if you never act, the
run ends when AWS expires the device code and Frost posts a fresh
notification for the sign-in that replaces it. A refresh that comes due
while you are away waits for you rather than notifying an empty room, so
the code behind the notification you do get is always a live one.
Note that the sign-in request is started before the notification is posted, so the window that opens later is the one AWS is already waiting on.
The Test button
Test fires a sample notification. Two reasons to use it:
- on macOS, the first notification is what triggers the system permission prompt — press Test once and allow it, or notify mode will be silent;
- it confirms notifications reach you at all before you rely on them, which is worth checking on Windows and on Linux desktops with their own notification handling.
Login Page
Where the AWS sign-in page opens.
| In-app window (default) | Default browser | |
|---|---|---|
| Hardware security keys | Yes, with an on-screen prompt | Yes, with the browser's prompt |
| Passkeys & password managers | No | Yes |
| Existing IdP session | Separate from the browser's | Shared with the browser |
| Cancelling | Close the window; the run aborts at once | Nothing to close; the run waits for the device code to expire |
Pick the browser if you sign in with a passkey or a password manager extension; keep the in-app window if you use a hardware key or your identity provider session usually carries you through. More about signing in →
Approve automatically
On by default. Frost loads the AWS approval page off screen and clicks through its steps itself, so a refresh that your identity provider session still covers finishes without showing anything. The login page appears — in the Frost window, or in your browser if that is the mode you picked — as soon as it asks for something only you can give, or if the flow stops making progress.
In notify mode it also decides what you are told: instead of a notification before every refresh, you get one only when a sign-in needs you, and nothing opens until you press the hotkey or click it.
Turn it off to watch every sign-in happen. Nothing else about the flow changes; the same pages open, in the same place, with the same steps for you to click. How automatic approval works →
Clear cookies and local storage
The in-app login window keeps its cookies and local storage between sign-ins — that is what lets a federated identity provider carry you through a refresh without asking anything. Clear Cookies throws that away, so the next sign-in starts from scratch. Two reasons to use it:
- Signing in as someone else — a second AWS identity, or a colleague's account on a shared machine.
- A login page that has wedged itself — a half-finished redirect or a stale identity provider session that no longer resolves.
Frost asks for confirmation first, then reports ✓ Cleared. Your start URL, region, hotkey, profiles and run history are untouched — this clears the login window's browser state and nothing else. It does not affect the default-browser mode, where the session belongs to your browser.
Refresh Hotkey
A global shortcut, registered system-wide, that does one of two things depending on what Frost is doing:
- A notification is pending (notify mode, waiting for you) — opens the login page.
- Otherwise — starts a refresh, unless one is already running.
The default is ⌘⇧R on macOS and Ctrl+Shift+R
elsewhere. To change it, press Change and then the
combination you want; Escape cancels. Modifier keys on their
own are ignored — the recorder waits for a real key. Save to register it.
A combination another application has already claimed cannot be registered, and Frost cannot always tell you so — the hotkey simply does nothing. If a new hotkey seems dead, try a different combination. Troubleshooting →
While you are recording, the current hotkey is suspended so pressing it records rather than firing a refresh.
Saving
Save applies all three settings at once (clearing cookies happens on the spot and needs no save). The hotkey is re-registered immediately; the mode and login page choices apply from the next refresh onwards. A refresh finishing in the background will not overwrite edits you have not saved yet.