Remote and mobile

Other devices show the same work

Remote browsers and the phone app connect directly to the HTTPS IP-and-port address of your PC or server. The AI and shell run on that computer. Signing in to orke with Google is separate from signing in to an AI account.

Prepare the PC first

1. Sign in to orke with your Google account. This PC remembers your account for future launches.
2. Prepare an HTTPS certificate. Have orke obtain one automatically from Let’s Encrypt, or import a PFX you obtained yourself. Follow the certificate instructions below.
3. In Settings > Connect from another device, enable “Automatic certificate management” or import a PFX, and choose a connection port (48650 by default).
4. Allow that TCP port through router port forwarding and PC or cloud firewalls, then enable external access. orke does not provide automatic port forwarding or a relay.
5. On a device on another network, open the copied https://PUBLIC_IPV4:PORT address and approve access with the same Google account.

“Waiting for connections” means the PC’s HTTPS listener is ready. A displayed address or ready listener alone does not confirm that it is reachable from the internet. The last confirmed connection is shown only after an actual authenticated external connection. Direct access may not work through carrier-grade NAT (CGNAT), corporate networks, or two layers of routers.

Prepare and renew an IP certificate

The certificate needs an IP SAN for the public IPv4 address you will connect to, server usage, a valid date range, a matching private key, and a trusted certificate chain. Do not bypass trust checks to use a self-signed or test certificate. If the IP changes, prepare a certificate for the new IP.

Let orke obtain and renew it automatically

In Settings > Connect from another device, go to “Automatic certificate management” and press “Set up automatic management.” Agree to the current Let’s Encrypt Subscriber Agreement, then press “Enable automatic management.” orke directly obtains a shortlived certificate for your public IPv4 address and renews it before expiration. Use “Request renewal” to request renewal immediately. Issuance attempts are at least 10 minutes apart.

Let’s Encrypt verifies control through external TCP port 80. Configure your router and firewall so port 80 reaches this computer, and keep it open for each renewal. You must prepare these rules yourself. If orke reports that it cannot open port 80, forward external port 80 to another local port and specify that port with the CLI’s --http-port option below. Keep orke running without administrator privileges. Actual issuance has been verified on an Ubuntu test server; issuance on Windows and macOS PCs has not yet been verified.

Import a certificate you obtained yourself

According to Let’s Encrypt’s Certbot IP certificate guide, Certbot 5.4 and later support IP issuance with webroot, with standalone and manual methods also available. The profile documentation (2026-10-04) gives a shortlived validity period of 160 hours. Plan renewals around that short lifetime.

The following is an HTTP-01 standalone example for a Linux server whose public IP you control. Install Certbot using its official instructions, check the version, and replace PUBLIC_IPV4 with the actual value. The certificate authority must be able to validate through external TCP port 80, without conflicting with an existing web server on port 80. TLS-ALPN validation by other clients requires port 443. Opening port 48650 alone does not prove control of the IP.

certbot --version
sudo certbot certonly --standalone --preferred-profile shortlived --ip-address PUBLIC_IPV4

If you already have a web server, use the webroot or manual method in the official guide. A certificate issued with --staging is not publicly trusted and is not a production certificate to import into orke.

sudo openssl pkcs12 -export -out /absolute/path/orke.pfx \
  -inkey /etc/letsencrypt/live/PUBLIC_IPV4/privkey.pem \
  -in /etc/letsencrypt/live/PUBLIC_IPV4/cert.pem \
  -certfile /etc/letsencrypt/live/PUBLIC_IPV4/chain.pem

Enter the password when OpenSSL prompts. Do not put it in command arguments. The PFX and private key are secret files. Set permissions so only the user running orke can read the required files, and do not send them to anyone else.

orke does not renew manually imported certificates. Certbot renewing the PEM files does not automatically update orke. Before expiration, create a new PFX from the renewed certificate and import it in Settings or replace it with the command below. Replacement ends existing remote connections while work continues.

Headless servers and the CLI

Run as the installation user with the same ORKE_HOME. Start orke first, then open the official approval URL shown by orke login on another device and sign in using the code. On Windows, orke must be running to change settings or import a certificate. Linux and macOS also support saving settings while it is stopped (this does not mean those behaviors were verified on each platform for this guide).

orke login
orke remote setup --certificate /absolute/path/orke.pfx --ip PUBLIC_IPV4
orke remote setup --port 48650 --enable

The PFX password is read through hidden input. For automation, pass it through standard input with --password-stdin. Do not put the password in command arguments, history, or logs. Use orke remote setup to inspect settings and orke remote setup --disable to turn access off.

To have orke obtain the certificate automatically, use the command below instead of importing a PFX. --http-port is the local port receiving forwarded external TCP port 80 (80 or 1024–65535, excluding internal ports 47620–48643, support port 48700, and the HTTPS port). Use --renew-certificate for immediate renewal and --manual-certificate to turn automatic management off. These commands require orke to be running and signed in. See Install on a Linux server for a server port-80 forwarding example.

orke remote setup --automatic-certificate --agree-ca-terms --http-port 48880 --port 48650 --enable

Connect from the phone app

1. Paste the HTTPS IP-and-port address copied from PC settings into the connection screen. A domain, HTTP URL, or approval callback URL is not accepted as a PC address.
2. Complete Google sign-in and the api.orke.bomtobe.com approval page in the system browser.
3. Return to the original phone app. The same WebView waits for approval, then opens the workspace.

Only the selected IP and port stay inside the app. Links to other origins and external links that open new windows use the system browser. When you reopen the app, choose from the PC list. In the workspace, pressing Back once shows a hint; pressing it again within two seconds leaves.

Sign out and turn access off

Signing out of My account on your PC revokes all remote access permissions and returns to the sign-in screen. Signing out remotely ends access for that browser only. Turning external access off also revokes access permissions only. Running tasks and PTYs remain active.

Account API, workspace, and support addresses

api.orke.bomtobe.com handles Google sign-in to orke and device and connection approvals. Terminal and web views travel directly to and from the PC’s HTTPS address, without passing through that server. support AI calls use an HTTPS proxy address connected to the separate 127.0.0.1:48700/v1 listener. See orke support for details.

When you cannot connect

• Check that the PC and orke are running, and that the current public IP, certificate expiration, and trust chain are correct.
• Check the connection port and router, cloud, and OS firewalls. Connecting on the same Wi-Fi alone does not confirm external access.
• Check that you selected the same Google account and kept the original app or browser waiting for approval.
• If your network does not allow direct connections, such as with CGNAT or a corporate network, ask the network administrator.