Open this box from a phone or another browser

Agents: claude, codex, opencode, cursor · On: phone, desktop · beta

Sign in to app.fezu.dev with the account this box is linked to, and the box opens. There is no code to type. The box lists every device that has opened it, and removes them. A device you removed pairs again with a code from the box.

Why you would use it

You want the same boxes on your phone, your laptop and a second browser without pairing each one with each box. Signing in is the step you already take; the box trusts the account.

How to use it

1. On the phone, open app.fezu.dev and tap Log in. You log in on fezu.dev and come straight back (use-the-app). Every box on the account opens.
2. On the box, v-code box devices lists the phone once it has opened the box.

Pair a device with a code

A device you removed from this box, or a new one past the box's 100 devices from the account, gets the pair screen in the app, with This box asks for pairing. On the box, run v-code box pair and type the code it shows.

To pair it:

1. On the box, make a code:

   v-code box pair
   # Pairing code: K7QM-3XRT (valid 10 minutes)
   # Box fingerprint: 0H1734S7NMRW5KJW
   

   Copy

2. On the phone, check that the fingerprint the app shows is the one the box printed, tap Yes, type the code and tap Pair. See use-the-app.

Remove a device

v-code box devices        # <id>  <name>  paired <time>  last seen <time|never>
v-code box forget <id>    # remove one

A device you remove stays out of this box until you pair it again. It gets the pair screen next time.

Options and settings

Limits and known gaps

• Your account is the key to your boxes. Whoever can sign in to your fezu.dev account (for example, with access to your email) can open every box on it, and a box runs code as you. No box setting keeps a signed-in device out; removing it does, until it pairs again. See trust-model-and-security-headers.
• A box lets a new device in only on the key that device registered when it signed in. The sign-in token carries that key, so someone who steals a token cannot open the box with a key of their own: they get unpaired.
• The box checks the sign-in token itself before it lets a new device in, so the relay between them cannot add a device of its own. A box whose clock is more than five minutes off lets no new device in through the account; its log says to check the box clock. Devices it already knows, and pairing codes, are not affected.
• A device removed on one box is removed there only. To stop a device on every box, remove it from your account on fezu.dev: it can no longer sign in.
• One pairing code at a time. Make a new one and the old one stops working.
• Codes live in memory. A restart of VCode spends the current one.
• Unlinking removes every device. The removed ids stay, so a relink does not let a removed device back in.
• A box lets at most 100 devices in through the account. Past that, a new device has to pair with a code.
• Rotating AUTH_TOKEN does not remove a device.
• Removing a device closes the channels it has open.

Related

• link-this-box: linking comes first
• add-a-workstation: link a new workstation with a join code from fezu.dev/account
• use-the-app: the phone's side
• work-on-several-boxes: every box on the account in one strip
• synced-settings: every linked box takes the account's settings
• trust-model-and-security-headers: what signing in to the account opens