Emergency containment

Emergency Device Revocation (<60s Stolen-Phone Kill Switch)

Lost a paired phone or suspect a remote session? Triggering account panic bumps your panicRevokedEpoch and entitlement generation on api.fromafar.app, blocking new relay tokens immediately and expiring cached off-desk grants within 60 seconds. If you are near your Mac, you can also sever every paired device locally in under a second—even completely offline.

Step 1 · Cloud & cellular relay kill switch

Revoke all off-desk grants & relay tokens

Submits an authenticated POST to https://api.fromafar.app/v1/account/panic. Stolen or prior sessions can no longer mint Iroh relay capabilities or refresh entitlement grants until you sign in afresh.

No active cloud session token is stored in this browser tab. Paste a signed Afar session token (JWS) below to revoke via api.fromafar.app, or use Step 2 on your Mac with zero sign-in.

JavaScript is disabled in this browser, so one-click web submission cannot run here. Use the offline local Mac controls below or call POST https://api.fromafar.app/v1/account/panic with an Authorization: Bearer <token> header.

Step 2 · Works offline in <1 second

Instant local Mac revocation (no cloud or internet needed)

Your Mac is always the final authority over its own screen, terminal and workspace files. Even if you have no cloud session token—or no internet connection—any of these three actions cuts off a paired viewer at once:

Press the menu-bar Stop shortcut (⌘.). While any viewer holds interactive control, Afar shows a persistent active-control indicator on your Mac. Press ⌘. or choose Stop Remote Session from the Afar menu-bar item to reclaim mouse, keyboard and stream access immediately.
Remove the lost device in Afar for Mac. Open Afar → Paired Devices, select the missing phone or laptop, and click Revoke Device. Its scoped device credential in macOS Keychain is deleted immediately while your other approved devices stay intact.
Restart or stop the local host service from Terminal. Run this command in Terminal on your Mac to drop every active local Wi-Fi, Tailscale and relay socket at once:
```
osascript -e 'tell application "Afar" to quit'
```

What happens during a panic revocation

Immediate relay admission block. Every call to POST /v1/relay/token and GET /v1/entitlements/grant compares the caller session’s panic_epoch against your account’s persisted panicRevokedEpoch in Cloudflare D1 and rejects older tokens with HTTP 403 account_panic_revoked.
Home Wi-Fi fallback stays under your desk’s control. Revoking cloud relay sessions never locks you out of your own computer; re-pairing requires physical two-handed confirmation at your Mac.
Need urgent security assistance? Review our Security Policy, explore device controls in the Account Preview, check Pricing, or write to security@fromafar.app (general support: hello@fromafar.app).