What a join code actually grants

A p2pmux session is a trusted shared shell. Anyone holding the code or ticket can see every pane and take interactive control of the terminals that are available. They can run commands as that Mac's user, read anything that user can read, and print a secret to the screen. Share it with people you would hand your unlocked laptop to, and nobody else.

There is a second half to that sentence, and both halves are true at once. Credential files and processes never leave the machine that hosts a pane: your API keys, your SSH keys and your logged-in CLIs stay on your disk, and a teammate driving your pane is running a program on your computer rather than copying anything to theirs. That is what makes "start Claude Code on my subscription, without giving you my key" work.

It is not a sandbox. Nothing stops a controller from running cat ~/.aws/credentials. If that distinction matters for a given collaborator, use a separate low-privilege macOS account and keep production credentials out of shared panes.

Where things run

Thing	Where it lives
Your shell, your agent, your build	Your Mac. Always.
Your API keys and credential files	Your disk. Never uploaded.
Terminal output and keystrokes	Encrypted, peer to peer — or through an iroh relay when NAT blocks a direct path. A relay forwards encrypted bytes it cannot read.
Tabs, panes, who is where	Between the peers in the session.

The one server we run

Joining takes a ten-character code instead of a two-hundred-character ticket, and that convenience needs somewhere to look the code up. That is rv.p2pmux.com, and it is the only thing we operate.

It cannot read what it stores. Your client turns the code into two separate values: an address to store the record at, and a key to encrypt it with. Only the first is ever sent. The service receives an opaque handle and a sealed blob, holds them for a few hours, and hands them back to whoever presents the same handle. There is no configuration of that service that reveals a ticket, because the key never reaches it.

Terminal bytes never pass through it. Those go peer to peer, or over an iroh relay.
Records expire on their own, and a session deletes its own record when it exits.
No accounts, no email, no analytics on it.
Skip it entirely if you like: p2pmux ticket prints the full ticket, and p2pmux join <ticket> never contacts us.

We do not claim "no servers". iroh's public relays exist and carry encrypted traffic when a direct path cannot form, and the code lookup above is ours. What we claim is narrower and checkable: your processes and your credential files stay on your machine.

Limits worth knowing

A code is a bearer credential with no revocation yet. Anyone who obtains it can join for as long as the session lives.
Codes are not one-time. They expire, but a code read once can be read again inside its lifetime.
Session locking exists (Ctrl+P then Shift+L) and refuses new peers, which is the tool for "everyone who should be here is here".
Up to 8 members, 9 tabs, 8 panes per tab.