Pairing & remote access
Pair another device over LAN or VPN, approve its access, and use its network token safely.
Nothing leaves the machine, except when it does
That guarantee holds for loopback calls only. LAN access and approved webhooks send meeting data over your network to the chosen target.
Reach: computer vs. network
Every token has a reach level:
computer- loopback only, plain HTTP, on the host. This is the built-in CLI credential and the default for a self-issued app key.network- LAN or VPN access over HTTPS with a pinned self-signed certificate. A paired device gets this reach; you can also create an app key with network reach.
Turning on LAN does not make a computer-reach token work from another machine. Network-reach keys and paired devices cannot hold Delete.
No relay, no NAT traversal
Meetily has no internet relay or NAT traversal. The other device must be on the same LAN or on a VPN that can reach the host.
The pairing lifecycle
On the host, turn on the Automation API in Settings > Integrations, then turn on Advanced > Incoming (LAN). Confirm the Gateway has bound HTTPS port 8421 and your firewall and LAN/VPN let the other device reach it. In Apps & scripts, choose Pair a device to open the ten-minute pairing window; opening it alone does not bind LAN.
The sheet shows the certificate fingerprint and a Copy button for meetily-pro pair https://THIS-COMPUTER-IP:8421 --fingerprint .... On the other device, use the installed CLI, replace THIS-COMPUTER-IP with an address of the host reachable over your LAN or VPN, and check the full fingerprint against the sheet through a trusted channel with the host's operator. If the fingerprint is not available yet, wait rather than using CERT-FINGERPRINT. No pairing code is needed.
Run the corrected command on the other device. It requests Read, Record, and Write by default; add --scopes read before running it if Read alone is enough. On the host, check the requested access in the Pair a device sheet and choose Allow. The CLI prints the 90-day network token once; paired devices cannot receive Delete.
In Settings > Integrations > Apps & scripts, turn on the paired device's Allow control. Store the printed token in a file readable only by you, then make a call from the other device with meetily-pro --server https://HOST-LAN-IP:8421 --token-file /path/to/paired-token whoami, replacing both placeholders.
Closing the ten-minute discovery window stops new requests, not already-paired devices. A submitted request has its own five-minute expiry and can still be approved after discovery closes.
Trust bootstrap: pinning the certificate
The LAN listener uses a self-signed HTTPS certificate, not a public CA chain. The CLI needs the host's SHA-256 fingerprint verified out-of-band before its first request and saves that pin for later calls to the same host; never trust whichever certificate happens to answer first.
Safe-posture checklist
- Loopback is enough for CLI and MCP clients on the host; leave LAN off if you do not need remote access.
- Keep the one-time bearer token secret. File permissions protect it from other OS users, not programs running as your account.
- Turn Incoming (LAN) off when you no longer need remote calls. Meetily does not configure your firewall or router.
Starting a recording remotely
A paired device granted Record can stop, pause, and resume recording. To start a recording remotely, the host must set remote_recording_prearmed to true in gateway_config.json in Meetily's data folder (~/Library/Application Support/pro.meetily.ai on macOS or %APPDATA%\pro.meetily.ai on Windows) and restart Meetily. Leave this off unless remote starts are intended; calls from the host do not need it.
Related
Last updated on