Remote Browser Access

The OpenCode Mobile app is the primary way to use a paired machine. Cloud Link also exposes the OpenCode web UI to a normal browser through the same public URL, protected by a separate browser credential.

Where to find the credentials

Open the connector popover and show the browser access panel. It contains:

• Public URL — the stable https://m-<random>.opencodecloud.link address.
• Username — browser.
• Password — a random 64-character value generated by the connector.
• Copy actions for the URL and each field.
• Regenerate for the password.

The browser credential is stored with the same protection as the tunnel token: the native credential store on macOS and Windows, or a protected file on Linux. The control plane never sees it.

Sign in

1. Open the public URL in a browser.
2. Enter the username and password from the connector.
3. If the password is not accepted, copy it again rather than retyping it.
4. Regenerate the password if it was exposed or you want to sign out every existing browser session.

Regenerating the browser password does not affect the mobile app’s device credential.

Browser versus mobile app

Access	Credential	Best for
OpenCode Mobile	Signed, expiring device credential	Starting and steering sessions from a phone
Remote browser	Connector-generated username/password	Reviewing a session or using the web UI on another computer
Local OpenCode window	Short-lived, single-use pairing link	Opening the managed web UI on the same machine

The tray’s Open OpenCode action opens the managed web UI in its own window. It uses a short-lived pairing link against the loopback server, so it does not need the browser credential. Local browsers can use the same kind of link when the connector offers it.

Exposed services are separate

Loopback services published through Cloud Link are served on their own ports and origins, not on the OpenCode origin. A browser credential for OpenCode does not automatically authorize a service path, and a public service is reachable by anyone with its URL. See Exposed services.

Security notes

• Treat the public URL and browser password as secrets.
• Regenerate the password after sharing a screen or using an untrusted browser.
• Close browser sessions you no longer need.
• Deleting the machine retires the tunnel and DNS record.
• There is no per-device revocation for browsers; rotating the password is the supported way to invalidate them.

If the browser shows a repeated authentication prompt, confirm the tunnel is connected and copy the credential again. If the public URL does not resolve, check the connector’s Tunnel status and Troubleshooting.