Keep a Mac or Linux host available for remote work

An always-on host owns terminal sessions and jobs independently of the desktop window. Use it on a Mac or Linux server you want to reach from another computer, iPhone, or iPad.

The machine must stay awake, powered on, and connected. Always-on host does not make a sleeping laptop reachable.

Install the host

First install the CLI, then run:

tokenstat host install
tokenstat host

On macOS, this enables the same launchd service as the desktop app's Always-on host setting. On Linux, it installs a user service that can remain running after logout. The user needs a systemd login session and permission to enable lingering.

Install from the login session of the user who should run the agents. A root installation runs the host and agents as root. tokenstat host shows the account the service uses. Cross-user --run-as installation is not supported.

Link the machine and enable remote access

Link the host and your other device to the same tokenstat account. tokenstat host install --code WXYZ-1234 can use an account-link code during installation. Enable remote access on the host.

Account-based remote management requires Patron or Legend. Screen viewing and control require Legend. See pricing for device limits and relay allowances.

Approve a device

Account membership alone does not grant access to files, terminals, or agents. On the host, inspect pending requests and approve the intended device:

tokenstat host access
tokenstat host access allow <device>

Alternatively, create a one-time invitation on the host:

tokenstat host access invite

The code expires after fifteen minutes and can be used once. Redeem it on the device requesting access. The host creates and verifies the invitation. The website cannot grant host access.

Review grants in the app's Devices area and inspect the host's access log:

tokenstat host access log

Screen viewing and control are separate permissions. Follow remote screen access for those grants and macOS permissions.

Check a connection that stopped working

Start with the host, then check its account link, remote-access setting, and the requesting device's grant:

tokenstat host
tokenstat host logs --follow
tokenstat host access

Confirm the host is awake and online. Use tokenstat host start, stop, or restart to manage the service. Stopping it interrupts the work it owns. Closing a window is a different action.

Remote connections try a direct path before using the encrypted relay. Direct traffic does not consume relay allowance. Relayed traffic does. A reached host can still reject a device that has not been approved.

Remove the service

tokenstat host uninstall

This removes the service without deleting your project folders. See uninstall tokenstat for removing the rest of the installation.