Mobile Remote Relay
Tech Connector mobile sessions support two transports:
- LAN mode talks directly to the authenticated desktop HTTP server.
- Remote mode sends the same bounded API requests through the first-party HTTPS
relay at
remote_mobile_relay_url.
The desktop always initiates the remote connection. No workstation port is published and no router configuration is required.
Pairing flow
- The signed-in desktop creates a relay session with its short-lived account access token.
- The backend returns a five-minute, single-use pairing code and a separate opaque desktop credential.
- The desktop's local QR view encodes the hosted
/mobile/URL, relay session, one-use code, and a locally generated AES-256-GCM key in the URL fragment. Browser URL fragments are not sent to the relay. - The mobile client exchanges the code for a role-scoped mobile credential.
- The phone encrypts each request end-to-end. Opaque envelopes are queued
briefly in memory. The desktop retrieves and authenticates them by outbound
HTTPS long-poll, executes them through the existing
ApplicationCommandService, and returns a bounded response.
Desktop and mobile credentials cannot be substituted for each other. Pairing codes cannot be reused. The relay never receives the end-to-end key and cannot read request or response content. Opaque envelopes are not written to the database or disk, responses expire after two minutes, and sessions expire after 24 hours.
Configuration
Desktop defaults:
remote_mobile_relay_enabled = true
remote_mobile_relay_url = https://relay.theentireworld.net
Backend deployment:
TC_MOBILE_RELAY_PUBLIC_URL=https://relay.theentireworld.net
TC_MOBILE_APP_PUBLIC_URL=https://relay.theentireworld.net/mobile
If account authentication or the relay is unavailable, starting Mobile Second Screen falls back to the LAN transport and says so explicitly.
Deployment boundary
The relay is a dedicated process and hostname, separate from the licensing API.
Its initial store is intentionally ephemeral and process-local. Run one relay
worker/instance for this release. A horizontally scaled deployment must
replace MobileRelayService storage and wakeups with a shared TTL store and
broker (for example Redis) before enabling more than one instance. Backend
restart or scale-to-zero ends active remote sessions; reconnecting creates a new
session. LAN sessions are unaffected.
Remote screen preview is capped at two frames per second to keep bounded HTTPS relay traffic reasonable. LAN mode retains its higher frame-rate options.