Enroll your phone & pair

Two QR scans stand between a fresh install and controlling your agents: one enrolls the phone with your hub, then one per machine pairs it with that machine's bridge.

1. Get beta access

Join the C3 beta waitlist. When access opens for your platform, the invitation includes the current release and enrollment path.

2. Enroll with your hub

On the hub machine, either open C3 Desktop → Phones → Mint enrollment QR or run:

c3sync hub control enroll-phone --name "My phone"

This prints a QR code in the terminal. In the app, tap Scan on the empty Signal screen (or Settings → Scan another bridge later) and point the camera at it.

The QR carries everything the phone needs to trust your hub and nothing it doesn't: the hub's WebSocket address, the CA pin, and a short-lived enrollment secret. The phone generates its own credentials locally — private keys never leave the device — proves possession of the enrollment secret, and receives its signed hub credential. From then on it connects only to your hub, over a certificate-pinned WebSocket, and rejects any other certificate.

NOTE — > The QR code is a secret while it's valid. Run the command where only you can see the terminal, and let it expire if you're unsure it stayed private — enrollments are cheap to re-mint.

3. Pair with each bridge

Enrollment gets you to the hub; pairing establishes end-to-end encryption with each machine. On a machine with a bridge installed:

c3bridge pair

Scan the one-time QR in the app. Phone and bridge perform a mutual key exchange with key confirmation — each side proves it holds the QR secret before anything is stored — and derive a long-term pair key that the hub never sees. Offers expire after 5 minutes by default (--minutes 1–10).

Repeat for every machine. Each pair is independent: unpairing or revoking one machine never affects the others.

4. Verify

The Signal screen should now show your host(s) on the map. Open the Sessions tab — every Herdr workspace and running agent on the paired machines should be listed. Open one, and you're in the session cockpit.

If nothing appears, run c3bridge doctor on the host and see connection & pairing troubleshooting.

Enabling notifications

To get pinged when an agent blocks on a permission prompt, opt in under Settings → Notifications. Alerts are deliberately generic — "an agent needs your attention," never which one or why — so nothing sensitive transits push infrastructure. Details in Notifications.