CatermVerified identity
Browser API requests use signed Firebase ID tokens. The API derives identity from verified claims rather than browser-supplied profile fields.
SECURITY BY CLEAR BOUNDARIES
Control starts with
the machine owner.
Caterm is designed around outbound device connections, verified identity, explicit capabilities, and narrow access.
One-time enrollment
Short-lived enrollment codes can be redeemed once. Device credentials can be rotated or revoked without deleting event history.
Scoped file access
File access is confined to one configured root. Terminal capability defaults to enabled and can be disabled locally. There is no unrestricted command API.
Agent execution permissions
Codex and Claude Code run on your device. Their native permission settings govern tool access; Full access can reach files and the network beyond the selected project. Caterm relays and stores conversations on its server.
Encrypted transport
Production deployments must use HTTPS and secure WebSockets. Sensitive API responses are marked no-store.