---
title: "Remote Browser Access"
description: "Open your Cloud Link machine from a desktop browser with the connector-generated URL and credentials, and regenerate the browser password safely."
canonical: "https://opencodecloud.link/docs/browser-access/"
lastUpdated: "2026-10-19"
---
The OpenCode Mobile app is the primary way to use a paired machine. Cloud Link
also exposes the OpenCode web UI to a normal browser through the same public
URL, protected by a separate browser credential.

## Where to find the credentials

Open the connector popover and show the browser access panel. It contains:

- **Public URL** — the stable `https://m-<random>.opencodecloud.link` address.
- **Username** — `browser`.
- **Password** — a random 64-character value generated by the connector.
- **Copy** actions for the URL and each field.
- **Regenerate** for the password.

The browser credential is stored with the same protection as the tunnel token:
the native credential store on macOS and Windows, or a protected file on Linux.
The control plane never sees it.

## Sign in

1. Open the public URL in a browser.
2. Enter the username and password from the connector.
3. If the password is not accepted, copy it again rather than retyping it.
4. Regenerate the password if it was exposed or you want to sign out every
   existing browser session.

Regenerating the browser password does not affect the mobile app's device
credential.

## Browser versus mobile app

| Access | Credential | Best for |
| --- | --- | --- |
| OpenCode Mobile | Signed, expiring device credential | Starting and steering sessions from a phone |
| Remote browser | Connector-generated username/password | Reviewing a session or using the web UI on another computer |
| Local OpenCode window | Short-lived, single-use pairing link | Opening the managed web UI on the same machine |

The tray's **Open OpenCode** action opens the managed web UI in its own window.
It uses a short-lived pairing link against the loopback server, so it does not
need the browser credential. Local browsers can use the same kind of link when
the connector offers it.

## Exposed services are separate

Loopback services published through Cloud Link are served on their own ports
and origins, not on the OpenCode origin. A browser credential for OpenCode does
not automatically authorize a service path, and a public service is reachable
by anyone with its URL. See [Exposed services](/docs/exposed-services/).

## Security notes

- Treat the public URL and browser password as secrets.
- Regenerate the password after sharing a screen or using an untrusted browser.
- Close browser sessions you no longer need.
- Deleting the machine retires the tunnel and DNS record.
- There is no per-device revocation for browsers; rotating the password is the
  supported way to invalidate them.

If the browser shows a repeated authentication prompt, confirm the tunnel is
connected and copy the credential again. If the public URL does not resolve,
check the connector's Tunnel status and [Troubleshooting](/docs/troubleshooting/).