Device access
Every device that reaches a host through Offsite’s own paths has an entry on that host: a record of its key, its name and since when it may connect. How a device gets one is on Pairing devices. This page is about seeing it and taking it back.
See a device’s status
Section titled “See a device’s status”Open the host’s menu: the ⋯ on the host row on the Mac, the host row in the iPhone’s host list. A line tells you where this device stands:
| Line | Meaning |
|---|---|
| This device is authorized since 15 Oct 2026 | the host accepts this device’s key (on the iPhone: This iPhone is authorized since …) |
| This device is not authorized | on the Mac, you connect with a password or your SSH key only, and Authorize this device… adds the key; an iPhone pairs with a fresh code |
| Access revoked | the host no longer accepts this device’s key |
| Revocation unconfirmed | you revoked, and the host’s answer did not arrive |
This Mac is the host itself; its menu has no such line.
Revoke a device
Section titled “Revoke a device”Two clicks from the open menu: Revoke this device’s access… (on the iPhone Revoke this iPhone’s access…), then Revoke access. The device has to be connected to the host for this.
What happens at once:
- The host stops accepting the device’s key, on every path: local network, Tailscale and relay.
- The device’s open connections end within a few seconds.
- The host replaces its current pairing code, so no code shown before the revoke works afterwards.
- Your sessions keep running on the host.
The relay does not need to be reachable for any of this. A revoked key stays revoked when the relay comes back, after a restart of the host, and when an enrolment the relay held while the host was offline arrives late.
The dialog names the way back before you confirm:
- a device that was paired with a QR or a host code pairs again with a fresh code;
- a device with the host’s password or your SSH key can still connect that way, and the app offers to authorise it again.
After a revoke
Section titled “After a revoke”Once a device knows its access is revoked, it stops connecting. The connection pill reads Access revoked, and the message says what to do:
- host no longer accepts this iPhone’s key. Pair again with a fresh code.
- On a password host: host no longer accepts this Mac’s key. Connect with the password, then authorize this Mac again from the host menu.
The same happens when the access was revoked somewhere else, for example on the host itself: an iPhone sees it on its next connect, a Mac when the host’s relay is on.
When the host does not answer
Section titled “When the host does not answer”A revoke needs the host’s confirmation. If none arrives within 15 seconds, the
menu shows Revocation unconfirmed. The app then does not retry, does not
reconnect over the device key and does not claim success, and the state
survives a restart of the app. Check the access on the host with
offsite-host relay list --json: a revoked record carries the time of the
revoke.
Forget a host
Section titled “Forget a host”Forget Host… on an authorised host comes with Also revoke this device’s access on host already ticked (on the Mac, while it is connected). With the tick, the host stops accepting the device first; then the host is removed from this device, saved password included. Without it, the host keeps accepting the device’s key.
Delete Saved Password… on the Mac (Clear Saved Password on the iPhone) removes only the password and leaves the authorisation as it is.
Revoke a device from the host
Section titled “Revoke a device from the host”A lost phone cannot revoke itself. On the host, list every authorisation with its name, source, fingerprint and dates, then revoke the one you mean by its key:
offsite-host relay list --jsonoffsite-host relay remove --pubkey <pubkey>The effect is the same as a revoke from the app: the key is refused at once and its connections close within seconds.
Details
Section titled “Details”- The host keeps the list in
~/.offsite/device-authorizations.json. A revoke marks the record with the time; records are never deleted, and a later pairing of the same device creates a new record. - A device that was paired before host 0.9.0 keeps its access and appears in the list with an unknown start date.
- Revoking changes nothing about the host’s identity: the host key your devices pinned stays valid.