# How your phone reaches it

> Over your own private network, straight to the machine. Nothing you look at travels through beafk cloud.

Your machine listens on `127.0.0.1` — its own loopback, which nothing outside
the machine can reach. No port is open to the internet. So how does a phone on a
train get to it?

## Your own network

Tailscale puts your devices — this machine, your phone, your laptop — on a
private network that only they are on. The machine publishes the panel there, at
an address like `https://kestrel.your-tailnet.ts.net`.

To your phone, that address is just a website. To everybody else it does not
exist: there is nothing to scan, nothing to brute-force, and no port to leave
open by mistake.

It works behind office firewalls, behind NAT, on mobile data, and on hotel
Wi-Fi, because Tailscale does that part.

## Permission comes from us; the connection does not

You sign in to beafk cloud in your browser. That is what we do: know who you
are, and whether you are allowed near this machine.

Your browser then makes a key **it cannot export**, and asks us for a
certificate for it. We sign one that says: this person, this device, this
machine. It is good for **five minutes**, because it is spent immediately, in
one handshake, and a copy taken out of a log afterwards is worth nothing.

Your browser presents it to the machine. The machine checks the signature by
itself, without calling us, and gives your browser a session of its own that
lasts **an hour**. Your browser quietly gets a new certificate before that hour
is up, for as long as you are still allowed in.

From that moment your browser talks **straight to your machine**. The
chat, the files, the commands, the diffs: none of it comes through beafk
cloud, and none of it is stored here.

```pieces
Your phone · a session an hour long, then a new one
Your machine · everything you look at, none of it through us
beafk cloud · a five-minute certificate, and nothing after it
```

## What that means in practice

- **We cannot read your chats or your code.** They do not pass through
  us. There is nothing to read.
- **We cannot get into your machine.** We hold no key that opens one. The
  certificate is issued *to your browser*, for its own key, which never leaves
  it.
- **A stolen copy of our database is a list of machine names** somebody still
  cannot log in to.
- **If beafk cloud is down**, only *opening* a machine needs us. Everything
  already running is unaffected — see
  [closing the tab](https://beafk.app/docs/closing-the-tab.md).

Field by field, what that leaves on our side is
[what beafk can see](https://beafk.app/docs/what-beafk-can-see.md).

## Cutting somebody off takes up to an hour

We stop signing for somebody the **moment** they lose their grant, their
session or their workspace — they cannot get into a machine again from that
second. But a browser already inside holds a session the *machine* gave it, good
for an hour, and the machine honours that by itself without calling us. So the
worst case is an hour, not a moment.

**If you need somebody out now, the answer is on the machine.**
`sudo beafk cloud forget` ends every open session on it at once, and the way
back is a fresh code. See
[disconnecting a machine](https://beafk.app/docs/disconnecting-a-machine.md).

## No pairing

There is no code to scan and no device to approve. Sign in on any browser and
you get a certificate. Access can also be taken away centrally: see
[your browsers](https://beafk.app/docs/your-browsers.md) for cutting one off, and
[who may open what](https://beafk.app/docs/who-may-open-what.md) for limiting a colleague to certain
machines.

## If you skipped Tailscale

The machine still works, but only from itself. Run `sudo beafk net tailscale`
on Linux, or `beafk net tailscale` on a Mac (no `sudo` — root cannot see
Tailscale's app), whenever you are ready, and it will get its address then.
Until it does, the panel has no way to reach it from your phone.

On a Mac the app has to be there: install it from the
[App Store](https://apps.apple.com/app/tailscale/id1475387142), sign in to the
account that owns your network, and turn the switch on in the menu bar so it
says Connected. The install will not put a daemon on a Mac for you; the
connect screen offers that App Store link if the app is missing.

## When it does not reach it

A machine that will not open is nearly always one of three things, and the first
is the phone you are holding:
[when a machine will not open](https://beafk.app/docs/a-machine-will-not-open.md).

---

beafk documentation · Your first machine · https://beafk.app/docs/reaching-your-machine

In this section:
- Your first machine — https://beafk.app/docs/your-first-machine.md
- How your phone reaches it — https://beafk.app/docs/reaching-your-machine.md (this page)
- Signing an agent in — https://beafk.app/docs/signing-an-agent-in.md
- A chat — https://beafk.app/docs/a-chat.md

Every page, one line each: https://beafk.app/docs/llms.txt
All of it in one file: https://beafk.app/docs/llms-full.txt