Kagi login QR code doesn't work on iPhone

bert

To reproduce:

On a computer, visit https://kagi.com/signin
On your iPhone, scan the QR code

The issue:

On iPhones, the QR scanner built into the native camera app opens an in-app Safari window that doesn't reuse cookies from the main Safari app. Therefore the QR code takes you back to the Kagi sign-in page. Furthermore, when the QR code destination loads in a not-logged-in window, the ultimate destination is lost, and you just end up back at Kagi.com/signin. There is no way (using the native iOS camera app) to get this QR code to work.

Either let the user log in on their phone after loading the QR code’s destination (and store the destination in the URL, like Kagi.com/signin?redirect-login-code=askjdhakshd, and have that log them in on the computer; or add a QR scanner to the Kagi app that performs this function. Otherwise, this function will simply not work on an iPhone without using a 3rd party QR code reader.

Dustin

FWIW, just tested this on my iOS device using the stock apps (Camera, Safari) and it worked as expected.

bert

Dustin What version of iOS are you on? IIRC in iOS 17 the camera QR code reader takes you to the Safari app, while iOS 18 keeps you in the camera app in an in-app Safari view (which lacks the full browser’s cookies).

Dustin

bert I don't have any iOS 17 devices so this may be a clue. On iOS 18 and iOS 26, everything is working for me.

RoxyRoxyRoxy

I'm not able to replicate this on my device (18.5). Just to clarify are you saying this only happens on iOS 17?

kirkmc

Works for me on an iPhone running iOS 18.5.

bert

Sorry all, I realized I described the issue incorrectly. If you use the stock camera app, then it works as expected. I realize that I was actually using the Control Center’s QR code applet (you can add it while editing Control Center). It is this purpose-built Control-Center-based QR code reader where the bug is manifest, because it loads an in-app Safari instead of kicking you out to the full Safari app.

But here is a similar flow that uses the stock camera app will reproduce this bug. The issue is manifest when the you visit the QR code’s URL in a browser not already signed into Kagi.

Open https://kagi.com/signin on a desktop browser where you're not logged into Kagi (or in a private window)
Open the stock iOS camera app
Point it at the Kagi login QR code from step 1
Tap the little QR code icon in the bottom right and copy the URL (https://kagi.com/settings/qr_authorize?t=long-random-string)
Open a new private tab in the iOS Safari app (so that you're not logged into Kagi)
Paste the URL copied in step 4 into the address bar and visit the page

The bug: when the page loads, the URL just becomes https://kagi.com/signin and the unique random string is gone from the URL. And thus when you sign in, the original login tab in step 1 isn't notified.