Step 7 — Remote access

By default your gateway listens only on your own machine (127.0.0.1). That's perfect for agents running on the same computer, but a hosted agent like ChatGPT, or one on another device, can't reach localhost.

Remote access fixes that. It gives your gateway a stable public URL, like https://g-xxxx.permaura.com, served over a secure tunnel. Two things stay true:

• Your gateway still runs only on your machine. Nothing about your keys or your data moves to the cloud.
• The tunnel is just a pipe to your gateway. Agents authenticate to Permaura and your gateway verifies them; the bytes go straight to your machine.

This is what makes the no-code remote agent flow possible.

Turn it on

Open Settings → Gateway. Your gateway has a Remote access control with two mutually-exclusive modes — a managed tunnel (the switch) or your own public URL (under Advanced):

Flip it on. Permaura provisions the tunnel and shows you the public URL, plus what your gateway needs to start serving it:

Now get your gateway running with remote access. How depends on how you run it.

Desktop app (easiest)

With the desktop app

The Permaura desktop app runs and supervises your gateway for you, so it does the rest automatically.

When you flip the switch on in the console, it shows a one-line setup code. Copy it, open the desktop app's Settings → Remote access, and paste it in. The app starts the secure tunnel and relaunches your gateway with remote access enabled. The app's Remote access section then shows your public URL and an "On" status.

To turn it off later, use Disable remote access in the same place (or flip the switch off in the console).

Headless / CLI

Running the gateway yourself

If you run the gateway from the terminal (curl … | sh, npx, or the binary directly) rather than the app, the console gives you two commands to run once. Copy them from the Remote access panel after you flip the switch on:

1. Start the tunnel — runs the connector that links your public URL to your local gateway:

   cloudflared tunnel run --token <your-token>

   (Install cloudflared first if you don't have it: brew install cloudflared.)

2. Restart the gateway with remote access set — these environment variables turn your gateway into a resource server bound to your tunnel and your account:

   PERMAURA_PUBLIC_URL=https://g-xxxx.permaura.com \
   PERMAURA_OWNER_SUB=<your-user-id> \
   PERMAURA_AS_ISSUER=https://permaura.com/api/auth \
   PERMAURA_AS_JWKS=https://permaura.com/api/auth/jwks \
   permaura-gateway

The console fills in the real values for you; the token is shown only once, so grab it while the panel is open.

Both steps matter

The tunnel alone isn't enough. Until the gateway is restarted with PERMAURA_PUBLIC_URL set, it won't verify Permaura sign-ins, and remote agents won't be able to connect. The desktop app does both steps for you; running headless, do both.

Bring your own tunnel

Prefer to run your own tunnel — ngrok, a Tailscale Funnel, or a custom domain? Under Advanced, choose Bring your own and paste the public URL your gateway is reachable at. Permaura registers that URL as the sign-in audience and stays out of the path entirely; it's only the handshake. Saving a bring-your-own URL turns off the managed tunnel, and vice versa — a gateway uses one or the other, never both.

Remote access (managed or bring-your-own) is a Pro feature. On the free plan the switch prompts you to upgrade.

You're remote-ready

Once it's on, your gateway has a public URL and is verifying Permaura sign-ins. Head back to Connect an agent; the Remote tab now shows your URL, and any agent — including ChatGPT — can connect from anywhere.

Turning it off

Flip the Remote access switch off in the console. Permaura tears the tunnel down, and (with the desktop app) your gateway is relaunched back to local-only. Running headless, stop cloudflared and restart the gateway without the PERMAURA_PUBLIC_URL variable.

The public hostname is stable: if you turn remote access off and on again later, you get the same URL, so anything you've already pointed at it keeps working.