Security and access

Fleet runs on your own machine and talks to nobody else by default. This page covers who can reach it and what they can do when they can.

Fleet listens on 127.0.0.1 port 6262. That is your own machine only, so nothing else on your network can connect. Use --host and --port to change it:

fleet --host 0.0.0.0 --port 2113

• Loopback only (the default). Requests from the same machine are signed in for you. No token needed.
• Any other address (0.0.0.0, a LAN address, a Tailscale 100.x address). Fleet asks every request for the access token, including ones from the machine itself. Reachable by other machines is the only trigger, so there is nothing else to switch on.

When it starts, Fleet prints a link like http://<machine>:2113/login?token=…. Open it once. The browser remembers the sign-in.

tailscale serve and other reverse proxies connect to Fleet over loopback. Fleet would take those requests for your own, so every device that can reach the proxy would be signed in.

fleet --port 2113 --require-token
tailscale serve --bg --https=443 http://127.0.0.1:2113

--require-token makes Fleet ask for the token on every request, whatever address it listens on. Use it whenever Fleet sits behind a proxy. Fleet also refuses automatic sign-in to a loopback request that carries a proxy’s forwarding headers, but don’t rely on that alone.

Settings → Machines → This machine shows the token and the addresses other devices can use. Fleet keeps it next to its database, in a file only you can read, so it survives restarts.

• Replace token makes a new one and locks out every device that has the old one.
• WEAVE_FLEET_AUTH_TOKEN (16 characters or more) fixes the token instead. Then only changing the variable changes it, and Replace token can’t.

Treat the token like a password. Whoever has it can do anything Fleet can: read files, run agents and open terminals. Don’t paste it into chats or commit it. If it leaks, replace it.

Another Fleet needs this token to add the machine. Fleet keeps the tokens of machines you add encrypted.

A phone gets its own key, not the machine token. See Fleet on your phone for the steps.

• The QR code works once and expires after 10 minutes. Its secret sits after the # in the address, which browsers never send to a server.
• Each phone has its own key. Removing one signs out only that phone.
• A key that goes 30 days without use stops working. Pair again.
• A paired phone can do almost everything the token can. It can’t read or replace the machine token, pair or remove devices, or change the list of machines.

Settings → Machines → This machine → Devices with access lists every paired device. Choose Remove to cut one off at once.

• Leave Fleet on 127.0.0.1 unless another device needs it.
• Behind tailscale serve or any proxy, add --require-token.
• Pair phones. Share the machine token only with a Fleet you own.
• Replace the token if you think someone else has it.

• More machines: make a machine reachable and add it.
• Fleet on your phone: pair a phone and remove it again.
• Troubleshooting: when a machine turns your token away.