Device Terminal

My Devices lists your computers with their CPU, memory and disk use, and opens a real shell on any of them from your browser. You enable it with one command on the machine; nothing on the computer has to listen on a public port.

How it works #

You run localtonet --terminal enable on the machine and approve the short code it prints in your dashboard. From then on a Terminal button opens a shell on that machine in a browser tab. The same shell is reachable from any terminal with an ssh command that the dashboard shows.

• The device only makes outbound connections. There is no inbound port to open and no SSH server to install.
• Opening a shell from the browser needs a fresh code from your authenticator app every time.
• Only the local command can turn the terminal on. It cannot be enabled from the dashboard.

Before you start #

• Localtonet on the machine. Minimum Localtonet App version required to use this feature: Desktop v8.6. Get it from the Downloads page.
• An AuthToken for that machine. Give each computer its own token: running one token on a second computer disconnects the first. The terminal works with tokens of your personal account, not with team tokens. See AuthTokens.
• Two-factor authentication. Opening a shell requires an authenticator app on your account. If it is not set up yet, My Devices shows Turn on two-factor authentication. See Account and security.

My Devices is in the menu of your personal dashboard. It is not shown while a team is selected.

Add a device #

1. Open Add device #

   Open My Devices and select Add device.

2. Choose the token #

   Choose an existing token, or select Generate new token to create one and put it in the command. If Localtonet already runs on this computer, choose its token. The list marks tokens that are online or already used on another device. A token that is connected right now shows a warning: use it only if Localtonet is running on this same computer.

3. Run the command on the computer #

   Copy the command from the dialog and run it in a terminal on the computer you want to add. If Localtonet runs as a service there, use an administrator terminal or sudo.

   On the computer

   localtonet --terminal enable --authtoken <YOUR_TOKEN>

   The command prints an approval code and waits:

   Output

   Approval code: ABCD-EFGH
   Open https://localtonet.com/devices, choose Add device and enter this code.
   Waiting for approval...

   When you run it as administrator or root, it first asks Run shells as user: and suggests your own account. Without those rights, shells run as the account that ran the command.

4. Enter the code and approve #

   Back in the dialog, type the approval code under 2. Enter the code it shows. Capitals and the dash are added for you, and you can paste the whole line the command printed. Enter the 6-digit code from your authenticator app and select Approve device.

   The command on the computer then prints Terminal enabled. Shells will run as … and the device appears in the list. It shows as online while Localtonet is running on it.

After approval, a command that you started by hand at a console carries on as a normal Localtonet run. In a script, or when Localtonet already runs on the device with this token, the command exits once the terminal is enabled.

Without anyone at the computer #

For a machine where nobody can read a code, for example a server you set up with a script, use a one-time key instead of the approval code.

1. In the Add a device dialog, choose the token and enter your authenticator code.
2. Open No one can read a code on that computer? and select Create one-time key. The key is valid for one hour and works once.
3. Copy the command and replace ACCOUNT with the user account that shells should run as on that computer.

localtonet --terminal enable --authtoken <YOUR_TOKEN> --terminal-user <ACCOUNT> --pairing-key <PAIRING_KEY>

With a valid key the device is approved right away and no code is shown.

Command options #

The device list #

The list refreshes by itself while the page is open.

Open a terminal in the browser #

1. Select Terminal #

   Select Terminal in the row of the device. The button works only while the device is online. The dialog tells you which account the shell runs as.

2. Enter your authenticator code #

   Enter the 6-digit code from your authenticator app and select Open terminal. The shell opens in a new browser tab.

Connect with ssh #

The Terminal dialog also shows a command under Or from any terminal, with nothing to install. It works from any computer with an ssh client. The command has this form, where <DEVICE> is the name of your device and <NODE> is the Localtonet server it is connected to:

ssh -p 24 <DEVICE>@<NODE>

Copy the command from the dialog: it shows the exact command for your device.

• The dialog shows the Server fingerprint. ssh shows a fingerprint the first time you connect. If it matches, you have reached Localtonet.
• If you have not added an SSH key, ssh shows a link to approve in your browser. The Approve connection page names the device and the IP address the request came from. Enter your authenticator code and select Allow connection, then go back to your terminal. The request expires after 5 minutes.

SSH keys #

Add your own computer's public SSH key so that ssh, scp and sftp connect without asking for approval in the browser.

1. On My Devices, select SSH keys.
2. Enter a Name and paste one line of your public key file, for example ~/.ssh/id_ed25519.pub, into Public key. Never paste your private key.
3. Enter your authenticator code and select Add key.

Accepted key types are ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521 and ssh-rsa. A key applies to all devices of your account. Select Remove next to a key to stop it from working. The dialog also shows an scp example for one of your devices:

scp -P 24 file.txt <DEVICE>@<NODE>:/tmp/

With the Localtonet client #

If Localtonet is installed on the computer you connect from, localtonet ssh connects too, and the session stays encrypted all the way to the device.

localtonet ssh <DEVICE>
localtonet ssh <DEVICE> -- uptime

Without a key it prints Approve this connection in your browser with a link, and continues once you approve. Everything after -- is run as one command on the device instead of opening a shell.

Access keys for scripts and AI agents #

An access key lets a script or an AI agent reach one computer without a browser. Anyone holding it can run commands there, so keep it private.

1. Select Keys in the row of the device.
2. Enter a Name, set Valid for (days) and enter your authenticator code. The key stops working after that many days, 3650 at most.
3. Select Create key and copy the key now. It will not be shown again.

Ways to use the key:

• ssh. Run the ssh command the dialog shows. When ssh asks, paste the key.
• Localtonet client. Pass the key with the --key option, as in the example below.
• MCP. AI agents connected to Localtonet's MCP server can pass the key to the RunDeviceCommand tool.

localtonet ssh <DEVICE> --key <ACCESS_KEY> -- uptime

The dialog lists the keys of the device with their expiry date. Select Remove to revoke one.

Elio #

The Elio button on My Devices is about Elio, the free and open source SSH client by Localtonet. You download it from elio.sh, sign in from Elio and approve the request in the dashboard with your two-factor code. Elio then sees the names and status of your devices. Opening a shell on one still needs that device's access key or an approval. The dialog lists the copies of Elio that are signed in; removing one signs it out.

Rename, remove or disable a device #

localtonet --terminal disable --authtoken <YOUR_TOKEN>
localtonet --terminal status --authtoken <YOUR_TOKEN>

Disabling always works on the computer, even when the dashboard cannot be reached. In that case the command tells you to remove the device in the dashboard too.

Security notes #

• A shell on a machine is full access to whatever its account can do. Choose the account shells run as with care; an unprivileged account limits what a session can change.
• Anything that can lead to a shell asks for a fresh authenticator code: approving a device, opening a terminal, creating an access key, adding an SSH key and approving an ssh connection.
• An access key or an added SSH key connects without that code. Give keys a short validity, store them like passwords and remove the ones you no longer use.
• After too many attempts in a short time the dashboard answers Too many attempts. Wait a minute and try again.
• Removing a device, or running --terminal disable on it, ends access for all of its keys.

Troubleshooting #

Related pages #