Hex Connect
Hex Connect is the optional service at connect.hexbot.app for reaching your daemon outside its local network. It gives the daemon a Cloudflare Tunnel and a hostname of 16 random characters, and it signs you in so your devices can prove they are yours. Chat traffic goes from your device to your daemon through the tunnel and never through Connect’s servers. Cloudflare decrypts it at its edge to route it, so for traffic Cloudflare cannot see, use LAN pairing or Tailscale. LAN pairing and Tailscale work without it. Connect is free during the beta.
Create an account
Go to connect.hexbot.app and create an account with an email address, a passkey, or a Google or GitHub account. One account owns any number of daemons and signs in from any number of devices.
Register a daemon
On the machine that runs your bots, run:
hexbot connect
It prints an address and an eight-character code. Open the address, sign in, and approve the code. A code approves one daemon; approving it a second time says it is already approved. If approving stalls, try again after two minutes or run hexbot connect again for a new code. Revoking the daemon while it is still registering wins: the daemon gets no credentials. The daemon stores its Connect credentials in ~/.hexbot/connect.json, starts its tunnel whenever hexbot serve runs, and reports in every five minutes. Give the daemon a different name with hexbot connect --name "Studio Mac". On a Headless daemon, run it over SSH; Connect does not need “Allow other devices”.
The daemon downloads a pinned, checksum-verified cloudflared binary for its tunnel.
Your daemons page shows a daemon as online only when its address answers. A daemon that reports in but whose tunnel is down shows as running but not reachable, and one that has not reported in for ten minutes shows as offline.
If the tunnel disappears on Cloudflare’s side, the daemon proves its tunnel credentials to Connect, repairs it, and keeps the same address. Tunnels registered before credential proofs were introduced, or before the service signing key was rotated, need hexbot connect again if repair fails. A daemon registered before owner pinning ignores its old registration and asks you to run hexbot connect again.
You can also register from the app: open Settings, choose Connect, and press Sign in and register. The app shows the same code and starts the tunnel as soon as you approve it.
hexbot connect status shows the registration and tunnel. hexbot connect disconnect stops the tunnel, removes the local credentials, and asks Connect to revoke the registration. If Connect cannot be reached, the daemon forgets the registration anyway and it stays on your daemons page. You can revoke a daemon there too, at connect.hexbot.app; revocation blocks new sign-ins and deletes its tunnel, and the daemon keeps working on its own network. If cleanup fails, the page shows “Removing…” with a Retry action until the tunnel is removed. Hexbot on the current version notices within a few minutes and forgets its registration; older versions stop working but keep the setting until you run hexbot connect disconnect on them.
Open a daemon in a browser
On your daemons page, press Open in browser next to an online daemon. Connect sends the browser to the daemon, which asks Connect to confirm who you are, and you land in your rooms and sections. Nothing to install: this works on a phone, a tablet, or someone else’s computer.
The browser then appears in that daemon’s Settings under Devices with a name like “Safari on iPhone”, and you can revoke it there like any paired device. Going straight to the daemon’s address shows a sign-in page with the same Sign in with Hex Connect button.
Starting browser sign-in from a LAN, Tailscale, or localhost address first redirects to the daemon’s tunnel hostname. Sign-in finishes on that hostname.
Sign in from the app
On a computer without a daemon, or in the client-only package, open Hexbot, choose Sign in with Hex Connect, and finish signing in in your system browser. Check that the code on the page matches the one Hexbot shows, choose Authorize, then return to Hexbot, which lists your daemons; pick one and you are connected over TLS. The app appears under Apps signed in with your account on connect.hexbot.app, where you can sign it out.
Behind the scenes the app receives a short-lived, single-use login grant and exchanges it directly with the daemon for a normal revocable device token. The daemon owner can revoke that device as with a LAN-paired device.
New apps can bind a device token to a key kept in the app profile, so copying the token alone does not grant access. This requires an updated daemon and working browser key storage. Older apps, older daemons, and browser cookie sessions keep their existing sign-in behavior. Cloudflare can still read the traffic; key binding does not add end-to-end encryption. Current daemons keep an Ed25519 identity key, and Connect stores its public key. When that key is known, Connect checks a signed response before showing the daemon as online, and the app checks it before sending a login grant. This detects misrouting and impostors that cannot reach your daemon. Cloudflare terminates TLS, so Cloudflare or whoever controls the Connect Cloudflare account or API token can relay a real daemon’s signature. The check cannot detect that active relay. Apps proceed without verification when no key is known or the browser does not support Ed25519. With a known key, a missing or invalid proof stops sign-in, including when the endpoint returns 404.
The daemon keeps its identity key in connect-identity.key, separately from
connect.json, so an older daemon rewriting its tunnel settings cannot erase
it. If Settings reports a different key in Hex Connect, disconnect and register
again. A key error leaves the daemon and tunnel running, but sign-in checks
remain blocked until the key is recovered. The app then says “
What Connect holds
Connect stores your sign-in identity (through Clerk), the names, hostnames, and public identity keys of your daemons, hashed service tokens, the device names of apps and browsers that signed in, and recent check-in times. It uses these records to list your daemons, issue login grants, and manage tunnels. The privacy policy lists every record and how long it is kept.
Connect never receives your conversations, bot memory, provider keys, files, tool results, or long-lived device tokens. It is not in the path your chat takes. The security policy explains the design.
Self-host Connect
The Connect service is AGPL software in apps/connect. Running your own instance requires a Clerk application, a Postgres database such as Neon, a Cloudflare account with a tunnel zone of its own, a Cloudflare API token scoped to tunnels and that zone’s DNS, a service signing key, and a Vercel deployment or compatible Next.js host. PostHog is optional.
Point a daemon at your instance with the HEXBOT_CONNECT_URL environment variable before running hexbot connect and hexbot serve. Point the app at it by setting hexbot.connect.url in the web bundle’s local storage, or VITE_HEXBOT_CONNECT_URL when building the bundle. Self-hosting the daemon alone does not require any of these services.
See apps/connect/README.md in the repository for the deployment checklist.