Step 7: Remote access
By default your gateway listens only on your own machine (127.0.0.1). That's perfect for agents running on the same computer, but a hosted agent like ChatGPT, or one on another device, can't reach localhost.
Remote access fixes that. It gives your gateway a stable public URL, like https://my-laptop.permaura.app, served over a secure tunnel. Two things stay true:
- Your gateway still runs only on your machine, and your keys and data are stored there, not in the cloud.
- Agents authenticate to Permaura and your gateway verifies them; their calls reach your machine through the tunnel, not through permaura.com.
For a managed permaura.app tunnel, permaura.com creates the tunnel and its name and hands the connector its credentials, and the gateway, or the desktop app, writes the connector's configuration on your machine, with one destination for your hostname: your gateway's port on 127.0.0.1. That file does not hold the connector there on its own. From Cloudflare's side, a different configuration could still be pushed to the connector, or private-network traffic routed through the tunnel to any address your machine can reach, so the gateway or the app watches for both and stops the tunnel within about a second if either happens, and says why. Permaura and Cloudflare also carry the traffic for your hostname, and What Permaura protects states exactly what that leaves them able to do.
The console and the Permaura app work differently once remote access is on: they reach the gateway through permaura.com, which relays their requests in memory and without logging them, including a credential you type there. The FAQ has the detail and how to keep a credential off permaura.com.
This is what makes the no-code remote agent flow possible.
Turn it on
How you turn it on depends on how you run your gateway. The desktop app can do the whole thing itself; running the gateway yourself takes one command.
- Desktop app (easiest)
- Headless / CLI
With the desktop app
Open the app's Settings, and on the Local Gateway tab find the Remote access card. Leave the
name field blank, keep permaura.app in the Domain type dropdown beside it, and press Enable.
That is the whole step: the app asks Permaura for a tunnel, starts it, and relaunches your gateway to
serve it. When it settles you get a
green dot and your public URL, with a button to copy it.
Your gateway is given a readable name on permaura.app, usually taken from your computer's name, so
a Mac called my-laptop ends up at https://my-laptop.permaura.app.
That name is yours to keep. It stays reserved for this gateway whether remote access is running or paused, so pausing it for an afternoon gets you the same address back and nobody else can take it in the meantime.
To choose the name yourself, type it in the name field before you press Enable, or later press Modify, change it and press Update. The same row can point the gateway at a domain you already own: pick custom domain in the Domain type dropdown and enter it, which is the bring your own route below.
Your public URL is the name. Change it and the old URL stops working, so any agent still pointed at it loses its connection until you update it. The app asks you to confirm before making the change. The old name is then held for your organization for 45 days, as Turning it off describes.
To turn it off later, press Pause on the same card: the address stays reserved, and Start brings it back. Delete removes remote access entirely and gives the name up, though it stays held for your organization for 45 days.
Running the gateway yourself
On the machine the gateway runs on, run:
permaura remote enable
It asks Permaura for a tunnel as this gateway, using the identity it was given when you paired it, so there is nothing to copy from the console. It writes the public URL and your account's sign-in settings into the gateway's config.toml, stores the tunnel's credentials in an owner-only file, and downloads a pinned cloudflared if the machine has none. To choose the address, give it a name: permaura remote enable my-vps answers on https://my-vps.permaura.app. Without one, Permaura picks it. Running it again with a different name moves the address and stops the old one working, so it asks for --yes first.
Then restart the gateway. The command prints how: sudo systemctl restart permaura for a systemd install, otherwise permaura stop and then permaura start. When it starts, the gateway writes the tunnel's configuration for the port it is listening on and runs the tunnel itself once it is answering, so there is no separate cloudflared to keep running, and a restart on another port takes the tunnel with it. permaura remote status shows the address and whether the tunnel's credentials are stored.
Two things have to be in place first. The gateway must be paired with your Permaura account (the installer's --pair, or permaura auth login), since that pairing is what the command asks with. And the managed tunnel needs Pro or above; on Free the command says so and stops. If the gateway runs as its own permaura account, the default for an install run as root, run these commands as that account, as Managing it shows.
permaura remote enable only writes the settings. Until the gateway restarts with them, it won't verify Permaura sign-ins, and remote agents won't be able to connect.
The console can start this too, from Enable remote access on the gateway's card under Settings → Gateway, but for a gateway you run yourself it only reserves the permaura.app name. The tunnel is created, and the address written, only when the machine running the gateway asks for it, so the console tells you to finish there: in the desktop app's Remote access card, or with permaura remote enable <name> and a restart. A rename from the console works the same way, and the gateway keeps answering on its old address until the machine takes the new one. A tunnel paused from the console is also brought back from the machine.
Bring your own tunnel
Prefer to run your own tunnel (ngrok, a Tailscale Funnel, or a domain you own)? In the console, on the gateway's card under Settings → Gateway, press Enable remote access (or Modify once it is on); in the desktop app, use the Remote access card. Pick custom domain in the Domain type dropdown, enter the address your gateway is reachable at (a hostname such as gw.example.com, or the full URL), and press Enable (or Update). Use your own domain covers that end to end: DNS, TLS, the proxy shape and the headers the gateway needs. Permaura registers that URL as the sign-in audience, and agents then reach your gateway directly; the console and the app still go through permaura.com, as above. Saving a bring-your-own URL turns off the managed tunnel, and vice versa: a gateway uses one or the other, never both.
The gateway tells local traffic from tunneled traffic by the standard forwarding headers an HTTP tunnel stamps on every request (ngrok, Tailscale Funnel, and Cloudflare all do). A raw TCP forwarder (ssh -R, a bare socat pipe) adds none, so remote traffic would look local to the gateway and reach controls that must stay loopback-only. Don't point one at a gateway.
The managed tunnel is a Pro feature, and on the free plan enabling one prompts you to upgrade. Bringing your own tunnel or domain works on every plan, Free included.
The managed tunnel follows your subscription. If the plan lapses it stops answering, and paying again brings it back as it was, unless the lapse has run its course and the tunnel has been deleted. Even then the name stays reserved for your gateway, so turning remote access on again after you subscribe again brings back the same address. The gateway's card under Settings → Gateway in the console shows when the tunnel is stopped and why, and Trials & billing has the timeline.
You're remote-ready
Once it's on, your gateway has a public URL and is verifying Permaura sign-ins. Head back to Connect an agent: the dialog now shows that URL, and any agent, ChatGPT included, can connect from anywhere.
Turning it off
Press Pause on the gateway's card under Settings → Gateway in the console, or on the desktop app's Remote access card. The public URL stops answering and the name stays reserved; paused from the desktop app, your gateway is also relaunched back to local-only, and Start brings it back on the same address. To give the address up, press Modify and then the red delete button in the console, or Delete in the app. A bring-your-own address has no Pause: remove it the same way. Running headless, run permaura remote disable on the gateway's machine and restart the gateway; the name stays reserved, and permaura remote enable brings it back.
A permaura.app name your gateway gives up, by a rename, a delete or disconnecting the gateway, is held for your organization for 45 days: a gateway in your organization can take it back, and no other organization can claim it. After that anyone can. An organization holds at most 10 given-up names at once, and giving up more ends its oldest holds early. Repoint agents configured with the old address, and remove and reconnect any that connected with a setup code, since the code stays that agent's token: an agent still sending to the old address would reach whoever claims the name once the hold ends. Permaura holds nothing for a domain of your own: whoever controls it next receives the calls sent there.
The public hostname is stable: if you turn remote access off and on again later, you get the same URL, so anything you've already pointed at it keeps working.
That's almost always the gateway not being restarted after remote access was turned on. Troubleshooting → Remote access walks it through.