Temporary Support

Temporary support lets you remotely help a stranger's machine without the other end registering an account — much like TeamViewer QuickSupport: the local user clicks once to generate a one-time support code and reads it to you, and you redeem it in the console to connect. The whole session is held capability-scoped by their host and is discarded once done.

A support code is essentially a device code with a bounded lifetime (TTL): it reuses that device's per-code capability ceiling (configured by the device owner under My Devices), and it goes through the same unified redemption as a device code — you type either a device code or a support code into the same connect box on the console home, and the server detects which.

Two roles

• Person being helped (the host) — on the host machine's Remote Support page (in the sidebar), they click "Get a support code". The host has the manager issue a one-time support code (bound to that device), shown on screen together with the remaining time. They read the code to you. Clicking "End support" — or letting the code expire — drops the session.
• Supporter (you, the controller) — signed in with your own account, type the code they read out into the connect box on the console home and connect to reach their desktop. You do not need to own or be granted access to that device; because you are not the device owner, this session is minted as a capability-scoped session.

Flow

Security model

A supporter is only semi-trusted, so the session is locked down and enforced by the host, not the signaling server:

• One-time and time-boxed — the code carries a TTL and expires; ending support from the host also drops it immediately.
• Capability-scoped (three-way meet) — for each action in a support session, the capability actually in force is the meet of the code's ceiling, the host's global access settings, and live approval. The device owner configures the per-code ceiling under My Devices (three-state: allow / ask / deny, or the View only / Assist / Full presets); when unconfigured it defaults to all-ask (every capability prompts the host user), never to full control. File browsing only permits directory listings and metadata; deletion is a separate destructive capability and requires both File browse and File delete. File transfer remains an independent upload/download capability. This replaces the older fixed rule that denied clipboard, file transfer and whiteboard outright.
• Signaling allow-list — only session-establishment and control-plane frames pass on a scoped session; any frame that could leak host credentials (such as the manager_api_token) is hard-denied on the host.
• No change to device ownership — a support code never grants the device to the supporter, and it is not recorded in your Recently connected list or device grid.

A support code cannot carry its own ceiling — it reuses the device's per-code ceiling. To tighten or open what a support session may do, adjust that ceiling under My Devices → edit the device.

Auditing: the supporter's act of redeeming a support code under their own account is recorded in the action log (with the supporter's account and source IP) for traceability.

Next

• Regular connections and how views are organized: Console Overview.
• How the ceiling shapes each action and the full three-way meet semantics: see the open-source docs' Access Codes and Signaling Authentication → Access-grant sessions (device & support codes) sections.