NexoPOS Client for Windows

NexoPOS Client is a lightweight desktop application that provides secure access to a NexoPOS installation running on another computer on the same local network.

The computer hosting NexoPOS runs NexoPOS for Windows in Network mode. Other computers use NexoPOS Client to discover that server, request approval, and open NexoPOS without manually entering an IP address or installing a certificate.

NexoPOS Client does not include PHP, Nginx, MariaDB, or the NexoPOS application itself. These services remain on the server computer. The client is a secure window into that existing installation.

The client can also run on the same computer as NexoPOS for Windows, although its primary purpose is connecting other computers on the local network.

Requirements

• NexoPOS for Windows must be running in Network mode.
• Network Access must be enabled on the server.
• The server must have an active Premium license to approve new devices.
• Both computers must be connected to the same discoverable IPv4 local network.
• Windows Firewall and the network profile must allow local discovery and gateway traffic.
• Guest Wi-Fi, client isolation, VPN routing, or managed network policies may prevent discovery.

The initial release of NexoPOS Client supports Windows. Other platforms require dedicated builds and platform-specific secure credential storage and networking support.

Connection security

All client traffic passes through the dedicated HTTPS LAN gateway provided by NexoPOS for Windows.

NexoPOS Client uses several protections:

• Certificate pinning: The client accepts the server certificate only when its public key matches the pin received during discovery and pairing.
• Per-device credentials: Every approved client receives a different random credential.
• Secure storage: Credentials are encrypted through Electron safeStorage, backed by Windows DPAPI.
• Main-process authorization: Credentials are attached to requests by the Electron main process and are not exposed to the NexoPOS web page.
• Isolated browser session: Each paired server receives a persistent Chromium session for its cookies and browser state.
• Sandboxed content: NexoPOS loads with Node.js integration disabled, context isolation enabled, and renderer sandboxing enabled.
• Restricted navigation: Unrelated external links open in the system browser.

The server stores only a salted hash of each credential, together with basic device metadata. It cannot recover the original credential from that hash.

If the server certificate changes but keeps the same public key, clients continue to trust it. Resetting the LAN server key changes the public-key pin, revokes existing pairings, and requires devices to pair again.

Virtual domains and NexoPOS sessions

NexoPOS commonly relies on a configured virtual domain for cookies, Laravel Sanctum, sessions, and CSRF protection. Loading the application directly through a server IP address can break those expectations.

NexoPOS Client preserves the configured NexoPOS and Print Server domain names. A local, application-managed proxy routes those domains to the discovered server address, so the remote application continues to see its expected host name. Users do not need to edit the Windows hosts file manually.