Handback

For headless, remote & agentic machines

When your machine
needs a browser,
Handback hands
it to you.

An OAuth login, a “click to authorize,” a localhost callback — triggered on a box you can't see, opened on the Mac, iPhone, or iPad in your hand.

Get Handback See how it works

One purchase for Mac, iPhone & iPad. The sender is free.

✓ logged in on agent-box

“A browser just opened on a machine I can't see.”

Agentic boxes and remote dev servers constantly try to open URLs in a browser nobody's looking at — and worse, OAuth flows redirect to localhost on that box, so the login hangs forever. Handback fixes both.

  1. 01

    It starts on a box you can't see

    codex login on your agent box wants a browser — and waits for the sign-in to call back to localhost:1455.

  2. 02

    The link lands on your phone

    Or on your Mac or iPad: the sender hands it to the app on your devices, and it's logged in that machine's history.

  3. 03

    You sign in, in the app

    The sign-in page opens right there, on the device in your hand.

  4. 04

    The callback goes home

    The app catches the localhost redirect and tunnels it back to the box. The terminal carries on.

Peer to peer

Nothing in the middle.

The sender on the box catches the link and hands it to the app on your device. When a CLI's sign-in redirects to localhost on the box, the app binds that port on your device and tunnels the callback back — so headless logins actually complete.

How Handback connects Inside your network, the free Handback sender on the box hands the link over the tailnet, LAN or a secure WebSocket to the Handback app on your Mac, iPhone or iPad, with no relay in between. When the sign-in redirects to localhost, the app binds that port on the device and tunnels the callback back to the box's localhost. YOUR NETWORK agent-box the box you can't see handback sender codex waits on :1455 Mac · iPhone · iPad your devices Handback app binds localhost:1455 01 the link tailnet · LAN · wss no relay in between 02 the OAuth callback, tunneled back from the device's loopback How Handback connects Inside your network, the free Handback sender on the box hands the link to the Handback app on your devices with no relay in between, and the app tunnels the OAuth callback from the device's localhost back to the box. YOUR NETWORK agent-box the box you can't see handback sender codex waits on :1455 Mac · iPhone · iPad your devices Handback app binds localhost:1455 01 the link tailnet · LAN · wss no relay in between 02 the callback
No relay
Your machines talk directly. There's no relay we run — nothing in the middle to leak, and no monthly bill to pass on. That's why it's a one-time price.
No account
No Handback server, no sign-up. Your link history — links can carry auth codes — stays on your devices.
Your network
A Tailscale tailnet (recommended), a TLS reverse proxy in front of the box, or your LAN. The app dials out to each box, so your laptop can roam.

More than an opener

A private, local-first dashboard of every link your machines hand back.

Every machine, one place

Connect all your agentic boxes. Each one's links land in its own history — searchable, never lost, stored on your device.

Opening is optional

Capture and notify by default; flip on auto-open per machine. Every link is logged whether or not a browser ever opens.

Loopback callbacks that finish

OAuth CLIs redirect to localhost on the box — unreachable from your laptop. Handback tunnels the callback back, so headless logins actually complete.

Up and running in a minute

The sender on your agentic box is free and open. Install it with Homebrew, pair once, done.

  1. 01

    Install the sender

    A tiny free daemon on your agentic machine (macOS or Linux) catches every browser link.

  2. 02

    Pair it

    Run handback pair — scan the QR or paste the URI into the app. One time.

  3. 03

    Get your links back

    Links open on the Mac in front of you. OAuth callbacks tunnel home automatically.

Full guide in the docs.

on your agentic box 
# install the free sender
brew install jereco/tap/handback

# capture browser links + pair with your devices
handback install --default-browser
handback pair --host your-box:8765 --qr

# keep it running
brew services start handback

One price. Every device.

Mac, iPhone & iPad on one purchase. Glance from the menu bar, or pick up where you left off on your phone.

Handback · one-time

On the box

The sender

Free

Open source · macOS & Linux · Homebrew

On your devices

The Handback app

One-time

A single purchase, not a subscription — price announced at launch.

  • Mac, iPhone & iPad (universal)
  • Unlimited machines & link history
  • Loopback OAuth callback tunnel
  • Free updates
Request early access

Launching soon — early-access seats are free until 1.0.

Questions, answered

Do my machines need to be on the same network?

No. The app dials out to each box, so your laptop can roam. Put both on a Tailscale tailnet (recommended), point the app at a TLS reverse proxy in front of the box, or stay on your LAN.

Why do headless OAuth logins hang without Handback?

CLI logins redirect the browser to localhost on the box (RFC 8252). If the browser is on your laptop, that localhost is the wrong machine — the code never arrives. Handback binds the port on your device and tunnels the callback back to the box, so the login just finishes.

Where does my link history live?

On your devices. There's no Handback server and no account — links (which can carry auth codes) never touch infrastructure you don't own.

What if no receiver is connected when a link fires?

The sender prints the URL right back into the terminal on the box, so it's never lost. Auto-opening locally is an opt-in for non-headless machines.

What runs on the agentic box?

A free, open single-binary daemon for macOS and Linux. It captures links via $BROWSER, xdg-open on Linux, or a default-browser helper on macOS — so tools like gh, gcloud, and agents that call open are all caught.

Why one-time pricing?

Because there's nothing for us to keep running. Your machines talk peer-to-peer; no relay, no sync service, no monthly bill to pass on.