Stuck on something? Here's the fastest way through.

On your device, always. Keys are generated locally in your browser or app and we only ever receive the public key. Config downloads and QR codes inject the private key on your side — it never touches our servers, so we can't leak what we never hold.

Add a device from your dashboard: name it, and a fresh keypair is generated on the spot. To rotate, use Rotate key on that device — a new public key replaces the old one immediately, and the previous key stops working. Removing a device revokes it right away.

Your device connects to a stable entry gateway, and its traffic exits from a region your plan allows. On plans with exit selection you can pin a preferred exit per device; otherwise the balancer picks a healthy one for you. Either way, each device is routed independently.

The control plane probes gateways continuously. If one falters, affected devices are rerouted to a healthy exit — typically in under a second and without restarting your tunnel. You keep your connection; only the exit changes.

Manage your subscription from the billing page in your dashboard. Changing plans carries your devices, keys, and pinned exits over — device limits and exit rights update to match the new tier. If card payments or crypto aren't enabled on this deployment, the billing page will say so instead of pretending to charge you.