Devices and roles

The hub has no passwords. Every request to it is signed by a device: a computer, or a server running pbx, paired with the hub once. pbx up pairs the computer it runs on as the hub’s owner.

The keys of a device

A device holds a signing key and a key-agreement key (both P-256) and a WireGuard key. Where they are kept depends on the machine:

Machine	Key store	Protection level
Windows	the TPM, the signing key behind a PIN	presence Built
Linux with a TPM	the TPM, with a PIN	presence Built
macOS	the Secure Enclave, with Touch ID	presence In progress for pbx
any machine	a key file protected by a passphrase you type	passphrase-interactive Built
a server or CI box	the TPM without a PIN, a key file unlocked by Tang, or a passphrase from a file	tpm, tang, passphrase-stored Built

The level is recorded at pairing and cannot change; a device that changes its key store pairs again.

A machine paired with several hubs has a device of its own for each. pbx hub list shows them; pbx commands says which hub a command talks to.

What a level allows

• presence devices can be owners and can approve.
• passphrase-interactive devices can be operators and viewers. A delete on production or staging is only asked for; a presence device approves it.
• Unattended levels (tpm, tang, passphrase-stored) also only ask for production admin access and operate logins, because no person is present.

Agent keys

A device also holds one agent key per coding-agent integration (Claude Code, Cursor, …), for pbx --agent and ownpaas’s MCP server. The hub holds every request signed with it to the agent’s ceiling (Coding agents).

• The first agent-mode run creates the key and registers it with the hub, signed with the device’s own key. On a presence device its person confirms that once; pbx agent register INTEGRATION does it ahead of time.
• pbx agent revoke INTEGRATION revokes it; an owner can revoke any device’s (--device ID). A revoked key stays revoked: pbx does not register it again on its own, a person runs pbx agent register again.
• An agent key never approves, pairs or registers keys.

Roles

Role	Can
owner	everything, including tokens, devices, the licence, deletes and allowing copies of production’s data
operator	releases, backups, restores, access, twins; deletes with the name typed
viewer	read

A second device

On an owner’s device, pbx pair invite --role operator --name ci-1 prints one string, valid for 10 minutes. On the new device, pbx pair <invite> pairs it through the tunnel; no SSH is needed. pbx devices lists the devices and pbx devices revoke removes one.