Frequently asked questions

Can SXAccess read my traffic?

No. Traffic is encrypted end to end between the two devices. The management service distributes public keys and access rules; the Discovery service forwards sealed messages; the relay forwards ciphertext. None of them holds a key that opens your payload.

Where are private keys stored?

On the device that generated them, in the agent's own state, and nowhere else. The management service only ever receives public keys.

What happens if the management service is unavailable?

Direct tunnels that are already up keep carrying traffic, because the management service is not in the data path. Tunnels that run through the relay keep working only while the relay is reachable. What stops is enrolling and signing in devices, applying edited access rules and negotiating new tunnels. A device that restarts during the outage cannot bring its tunnels back until the service returns.

Is the connection quantum resistant?

Optionally, and only with the CLI agent. Quantum resistance adds a post-quantum key exchange on top of the tunnel's own handshake. It is experimental, it is an option of sxaccess start, and the apps do not support it. See How traffic is encrypted.

Do I have to open a firewall port?

No. Agents dial outward only. See Ports and firewalls for the outbound list.

Will the overlay range clash with my LAN?

Unlikely. An organization's overlay range is one /16 chosen at random inside 100.64.0.0/10, the shared address space reserved by RFC 6598 - 100.72.0.0/16, for example - which is rarely used on a LAN. Private networks you make reachable can still clash with each other - see Networks and resources.

Why is a device marked as relayed?

Every tunnel starts on the relay and moves to a direct path once one is found, so a device can show Relayed for a moment after it connects. If it stays relayed, no direct path could be established, usually because both ends sit behind symmetric or carrier-grade NAT, or because UDP is blocked. The tunnel still works and is still end-to-end encrypted. In the apps, the Path on the Devices page shows whether a tunnel is direct or relayed. See NAT and connectivity.

Can I reach a device that cannot run the agent?

Yes - put the CLI agent on a machine on the same LAN and publish the printer, camera or appliance as a network resource. Only that one routing device needs the agent.

Does it work on IPv6-only networks?

Not fully. Overlay addresses are IPv4 only. On an IPv6-only network, an agent connects only if that network can still reach the management host: run sxaccess info and read the Service and Discovery rows, or see whether the app connects. A Device Network Range check accepts IPv6 ranges as well as IPv4 ones.

How do people sign in?

With Google (Continue with Google), with an email address and password, or with a passkey if the organization allows passkeys under Settings → Authentication. SXAccess runs the identity system, so there is nothing to host or configure, and connecting an identity provider of your own is not available. See Sign-in and Two-factor and passkeys.

What happens when someone leaves?

Block the member: on their Profile tab, choose Block user. That expires every device they enrolled by signing in, at once, and shuts them out of the dashboard. Devices enrolled with an enrollment key have no owner and keep working, so review those separately. Remove from this organization, on the same tab, deletes the devices they enrolled by signing in, along with their access tokens. See Offboarding.

Can a machine enrol without a human?

Yes - that is what enrollment keys are for. Use a one-off key for a single machine, or a reusable key with a usage limit and auto-assigned groups for fleets and CI.

How do I automate everything?

Create a service account, issue it an access token, and drive the REST API. See Service accounts and tokens and Public API.

Which platforms are supported?

The app runs on macOS (Mac App Store, or a direct DMG download; Apple silicon, macOS 14 or later) and on Windows (an MSI from Add device in the dashboard, or a direct download). On phones it runs on iOS (App Store) and Android (Google Play). The CLI agent runs on Linux and macOS and is installed with the install script. There is no desktop app for Linux, and no CLI on Windows or on a phone. See Which client do I need?

Does SXAccess reconnect after a restart?

The CLI agent does: it runs as a system service and reconnects on start-up, unless you started it with --disable-auto-connect. The apps reconnect only if you set them to. On macOS and Windows, turn on Launch at login and Connect on launch in Settings; both are off by default. On an iPhone, turn on VPN On Demand in the app's Settings; on Android, turn on Always-on VPN through Settings → Automatic connection.

How do I collect diagnostics for a support request?

sxaccess diagnose collect writes an archive of logs and status and prints where it saved it. For an intermittent fault, sxaccess diagnose capture 5m reconnects the device with trace logging, waits five minutes and then builds the archive; sessions over SXAccess drop while it reconnects. Add -A to replace public IP addresses and non-SXAccess domains; private ranges and overlay addresses stay visible. The apps have no such command; From the apps shows what each one offers instead. See Report a bug or get support.