Remote access from a server

contextcode serve brings up the same remote access as Channels → Web access in the app, but without opening a window. It is what you use on a server, a VPS or a machine that stays on at home.

Which URL the QR carries

There are three ways to publish the server, from most closed to most open:

How you start it	QR URL	When to use it
contextcode serve --print-qr	http://<local network IP>:8787	The phone is on the same Wi-Fi as the machine.
contextcode serve --public --print-qr	The machine’s fixed URL if it has one; otherwise a temporary Cloudflare URL	Server on another network or a VPS.
contextcode serve --stable --print-qr	The machine’s fixed URL under the Context Code domain	A server you connect to every day. Requires the plan with remote servers.

With --public, serve looks in this order:

1. The fixed URL the machine already has saved (the same one the app’s «Stable URL» button gives).
2. If there is none and you are signed in with contextcode login, it requests one from the tunnel service and saves it.
3. If that is not possible, it falls back to a temporary trycloudflare.com tunnel and warns that this URL changes on every start: the QR you scan will stop working when the server restarts.

--stable requests the fixed URL on every start, so it corrects itself if you changed the port.

With --print-qr and a public URL, the main QR is the public one and the local network URL appears below it.

If the fixed URL doesn’t come up

Read the notice serve prints on start. The usual causes are: you are not signed in (contextcode login --status), your plan doesn’t include remote servers, or the tunnel service key is missing; it is read from ~/.context/broker-key or the CONTEXTCODE_BROKER_KEY variable.

Running it as a service

contextcode serve --install --public

Installs serve as a service of your user with the same options you pass, and starts it:

• Linux: a systemd user unit (contextcode-serve); starts at boot, restarts if it crashes and logs to the journal. No sudo needed.
• macOS: a LaunchAgent.
• Windows: a scheduled task «at log on», no UAC.

The service keeps its token in a file (--token-file, ~/.context/serve-token by default, with 0600 permissions), so it doesn’t depend on the system keychain. When the installation finishes it prints the URL and the QR with that same token: that is the one to scan.

To remove it: contextcode serve --uninstall.

Seeing the QR again

With the service already running, don’t start another serve; use

contextcode conexion --qr

It takes the token from the installed service (or from the file you pass with --token-file) and shows the public URL if there is one. If you try to start a second serve on the same port, it stops with a message that explains it instead of a generic error.

Paired phones

When it scans the QR, each phone gets its own credential. You can list them and revoke their access without touching the link token:

contextcode dispositivos                          # name, id, paired, last used, IP
contextcode dispositivos --json
contextcode dispositivos revocar "Daniel's Vivo"  # by name, id or id prefix
contextcode dispositivos revocar --todos --si     # without asking for confirmation

The revocation takes effect immediately, even with the server running: that phone’s next request is rejected. Tokens and hashes are never shown.

The phone stays «connecting»

Check in this order:

1. That the QR belongs to the server that is running. If you ran serve --print-qr and then installed the service with --install, the service uses another token and that QR is no longer valid. Get the right one with contextcode conexion --qr.
2. That the phone can reach that URL. Open it in the phone’s browser: if the web loads, the network is fine. If it keeps loading, the phone is not on the same network or there is a firewall (sudo ufw allow 8787/tcp). Outside the local network, use --public.
3. That the service is alive: systemctl --user status contextcode-serve and journalctl --user -u contextcode-serve -n 50.

Whoever has the link is in charge

The link gives control of the agent on that machine: it runs commands and edits files. Don’t share it. If it leaked, revoke the phones you don’t recognize with contextcode dispositivos revocar and change the link token: delete ~/.context/serve-token and restart the service, which creates a new one.