Skip to main content
Wrapper uses Better Auth device authorization. The CLI prints a verification URL, you press Enter to open it, approve a short code, and the CLI stores a session token locally. The iOS viewer uses the same approval page with the code already in the URL.

​
Sign in

  1. The CLI prints a verification URL and user code.
  2. Press Enter to open the URL in your browser, or copy it if you are on a headless session.
  3. Sign in with your Wrapper account and approve the device.
  4. The CLI stores credentials and can mint short-lived Convex JWTs for backend calls.
While waiting for approval, the CLI may report authorization_pending. Leave the command running until you approve or deny the request. Optional flags for advanced setups:

​
Inspect and log out

Run wrapper auth logout on any device whose credentials may be exposed.

​
Where credentials live

Related state: Directories use restrictive permissions. Session tokens are redacted from logs.

​
Why auth matters for attach

Local attach uses the loopback token in the session registry. It does not require Convex or a Wrapper account. Remote share always requires auth, plus Pro for the relay entitlement. See Pricing. Development builds with NODE_ENV=development and no Convex URL can exercise host wrapping without a backend, but that is not the shipped binary path.

​
Auth origin

Device approval runs on the web origin from WRAPPER_AUTH_ORIGIN: See Environment for overrides.
Last modified on September 13, 2026