Devices and security

The device list describes installation identities and connection state known to the account. Online, reachable, signed in, and trusted for E2EE are separate states.

Understand device states

• Verifying: the App is still resolving account or device state and must not show signed-out or offline prematurely.
• Signed in: the device has a valid account session; this does not prove it is online.
• Online: the account directory can see a connection; this does not prove a control request was delivered.
• Trusted: device identity trust has been established for supported encrypted control.
• Directly reachable: the current App can access the Local API over local, LAN, or custom direct connectivity.

Establish trust

For a first cross-device connection, compare the identity or fingerprint displayed by the App and target CLI, then establish trust only after the target device has been verified. A device name alone is not sufficient evidence.

Generate the QR code

When new-device confirmation is enabled, the new device sign-in page generates an expiring QR code.

Complete confirmation

Scan the code currently shown on the new device with a trusted App.

Expired or mismatched code

The App does not retain a pending-device list. Generate a new code on the new device, then scan it again.

The last trusted App device cannot be removed while new-device confirmation is enabled. Disable confirmation first or add another trusted device.

E2EE boundaries

Device-to-device commands and content use end-to-end encryption over localhost, LAN, and the account relay. The server does not hold device private keys. It can still see delivery metadata required to route a message, including devices, message type, time, and size.

Accounts, budgets, subscriptions, and other data that the server must process are outside encrypted relay content. E2EE does not hide data the service must handle to provide those features.

A lost device private key cannot be recovered from the server. Before removing a device or rotating identity, confirm that another trusted device remains available for new-device confirmation.

Revoke a device

Before revocation

Check whether the device still hosts a remote agent, Remote Share, or a model route source.

After revocation

That installation identity must sign in and establish trust again before account control is restored.

Revoking a remote device signs it out and removes it from trusted devices immediately.

It does not remotely delete local data on that device. “Sign out and remove this device” on the current App also deletes its local device key.

Use these commands to inspect or rotate local CLI identity and Local API access:

originrouter security status

Inspect the current device security state.

Rotate the account device identity:

originrouter security rotate

Rotate the Local API access key:

originrouter local key rotate