Automatic network token. When accepting other computers (npm start does this) without COCKPIT_TOKEN, Cockpit generates a token stored in ~/.cockpit/server-token, restricted to your user. It is shown at startup. Local access needs no token; on another computer, open http://<SERVER_IP>:4000, choose Server token, and paste it. This is separate from the website's activation key. Outside a trusted network, use HTTPS: plain HTTP transmits the token unencrypted.
npm start listens on all IPv4 interfaces. Use the IP displayed in the terminal; 0.0.0.0 is a bind address, not a browser destination. Firewalls and WSL networking may need configuration.
Without an explicit COCKPIT_TOKEN, only loopback API access is unauthenticated. Network access requires an invitation or token, even using the server's network IP on the server itself.
To set a token without writing it to shell history:
read -rsp "Cockpit token: " COCKPIT_TOKEN
echo
export COCKPIT_TOKEN
node bin/cockpit.js --host 0.0.0.0
On Authorize this computer, choose Server token, enter it, and select Sign in with token. The browser receives a session valid for up to 24 hours for REST and WebSocket. The token itself is not stored in the browser; server restarts end these sessions. Invitation and HTTPS administration remain local-only.
The API accepts Authorization: Bearer <token>; API/WS also accept a token query parameter. Avoid sharing or logging URLs containing secrets.
Open Cockpit on the server via localhost, then Settings → Remote access, and generate a link/QR invitation with an address reachable by the recipient. Invitation management requires loopback and, when a token is active, authentication. A token in the page URL does not automatically authenticate every SPA request. You can use the authenticated API:
curl -X POST http://127.0.0.1:4000/api/remote/pairings \
-H "Authorization: Bearer $COCKPIT_TOKEN" \
-H 'Content-Type: application/json' \
-d '{"scope":"deliberate","baseUrl":"https://<SERVER_IP>:4443"}'
Replace the IP and use your configured HTTPS address. Open the returned pairingUrl on the device to authorize.
monitor: view-only, with changes blocked.deliberate: control actions permitted by the scope.
Revoke devices from the server as needed. The default listener serves HTTP without provisioning TLS or a tunnel; internet access requires a separate protected network/HTTPS layer. See Structure and documentation for Cockpit's HTTPS setup.