Remote access

Run the T3 Code server on one machine and use it from another — t3 serve flags, Tailscale, SSH tunnels, pairing tokens, and the remote-environment Node requirement.

Last reviewed 2026-07-27 · verified against the pingdotgg/t3code repo

The reason to bother: your code, your provider credentials and the agent all live on one machine — a desktop, a home server, a cloud box — and you drive it from a laptop or phone anywhere else.

There are three ways to set it up.

Option 1 — Desktop app network access#

Simplest if the host already runs the desktop app.

Settings → Connections → toggle Network access, then Create Link to generate a pairing link. The app offers several endpoint types depending on your network: LAN address, loopback, HTTPS/WSS, or a Tailnet address.

Option 2 — Headless server with the CLI#

The right approach for a machine with no desktop session.

# bind to a specific address
npx t3 serve --host 0.0.0.0

# bind to your Tailscale address — recommended
npx t3 serve --host "$(tailscale ip -4)"

# let Tailscale terminate HTTPS for you
npx t3 serve --tailscale-serve

# ...on a custom port
npx t3 serve --tailscale-serve --tailscale-serve-port 8443

t3 serve prints a connection string, a pairing token, a URL and a QR code. Scan the QR from a phone and you're connected.

Default backend port is 3773. Tailscale HTTPS gives you https://machine.tailnet.ts.net/, and a raw Tailnet IP looks like 100.x.y.z:3773.

Option 3 — Desktop-managed SSH launch#

The desktop app can start and manage a server on a remote host over SSH.

Settings → Connections → Remote Environments → Add environment.

The remote machine needs a compatible Node.js:

^22.16 || ^23.11 || >=24.10

T3 Code searches the remote PATH and the usual version managers: Volta, asdf, mise, fnm, nodenv and nvm. If it can't find a compatible Node, it will tell you — install one or make it visible on the non-interactive SSH PATH.

Security rules#

This is a service that runs arbitrary commands and edits files in your repositories. Treat it that way.

Avoid hosted pairing for plain HTTP LAN URLs — browsers block the mixed content and you'll get a connection that fails in a confusing way. Use HTTPS via Tailscale, or an SSH tunnel.

Plain SSH tunnel#

No VPN, no extra tooling, and it's the most conservative option:

# on the server — loopback only, unreachable from the network
npx t3 serve --host 127.0.0.1

# on your laptop
ssh -N -L 3773:127.0.0.1:3773 user@server

Open http://localhost:3773 locally. The server never listens on a routable interface; everything rides the SSH session.

Managing pairing credentials#

t3 auth

Inspects sessions, manages pairing credentials and revokes access. Run it periodically — pairing tokens accumulate, and a token from a laptop you no longer own is a live credential.

Full CLI reference →

The one limitation to plan around#

The GUIs do not currently support adding projects on remote environments.

Add projects with the CLI on the server machine instead:

t3 project

Worth knowing before you set everything up and wonder why the "add project" button isn't doing what you expect.

Known remote issues#

• Missing key at ["thread"]["sessionId"] — the Codex adapter rejects the app-server response over SSH. Restarting the remote t3 serve process often gets past it. Details →
• Port 127.0.0.1:9234 already in use — Codex remote connections use this loopback port; a leftover process blocks app-server bootstrap. Details →
• Sleeping hosts — a Mac that sleeps or a laptop that suspends kills running threads. Disable sleep on any machine acting as a host.

FAQ#

How do I access T3 Code remotely?#

Run npx t3 serve --host <address> on the host machine, then open the pairing URL it prints from your other device. Bind to a private address such as a Tailscale IP rather than a public interface.

How do I use T3 Code with Tailscale?#

Either bind directly to your Tailnet IP with npx t3 serve --host "$(tailscale ip -4)", or use npx t3 serve --tailscale-serve to have Tailscale terminate HTTPS and serve at https://machine.tailnet.ts.net/.

Is it safe to expose T3 Code to the internet?#

No. The server can run arbitrary commands and modify files in your repositories. Bind it to a private network address such as a Tailnet IP, or use an SSH tunnel, and treat pairing tokens as passwords.

What Node.js version do T3 Code remote environments need?#

Remote environments launched over SSH require Node ^22.16 || ^23.11 || >=24.10. T3 Code searches the remote PATH plus Volta, asdf, mise, fnm, nodenv and nvm installations.

Why can't I add a project on a remote T3 Code server?#

The GUIs don't yet support adding projects on remote environments. Use the t3 project command on the server machine instead.