Skip to content

Authentication

Jump to bottom
Jazzen Chen edited this page May 24, 2026 · 4 revisions

Authentication

VibeAround is local-first. Loopback access is trusted; public tunnel access is paired.

Trust Boundary

Access path Auth behavior
localhost Trusted
127.0.0.1 Trusted
::1 Trusted
Public tunnel host Pairing required

Pairing Flow

  1. Open a public tunnel URL.
  2. Browser shows a pairing code.
  3. Send the pairing code through a connected channel.
  4. VibeAround verifies the code.
  5. Browser receives an auth cookie.
  6. Subsequent requests use the cookie.

Protected Surfaces

Pairing protects:

  • Web Dashboard
  • Web Chat
  • Web Terminal
  • WebSocket routes
  • Preview URLs
  • local runtime APIs exposed through the public host

Credentials

Provider API keys are stored in local profile files. Channel credentials are stored in local settings. They are not sent to GitHub or the project repo by VibeAround.

Reset Auth

If pairing gets stuck:

  1. Clear the browser cookie for the tunnel host.
  2. Restart VibeAround.
  3. Open the tunnel URL again.
  4. Pair from a connected channel.

For shared machines, close public tunnels when not in use.

Clone this wiki locally