KiroPad.

An address is only half the connection.

KiroPad puts the connection address and a one-time pairing code into a QR code. Once paired, a separate session token carries access forward.

1. 01

   One scan carries the setup

   The QR code bundles the tunnel address and current pairing code. It gives the phone a connection route without asking someone to copy an address and a credential separately.

2. 02

   Pairing is a moment; access is a session

   A successful pairing issues a session token and replaces the pairing code. Reconnecting devices are checked against the stored session and its expiry.

The boundary lives in the check.

This small function is where an existing credential is accepted or rejected. The order is useful: find the session, check its lifetime, then record that it was seen.

validateSessionToken(token: string): boolean {
  const session = this._sessionTokens.get(token);
  if (!session) return false;
  if (Date.now() > session.expiresAt) {
    this._sessionTokens.delete(token);
    return false;
  }
  session.lastSeen = Date.now();
  return true;
}

A known session

An unknown token exits before it can update session activity.

A checked lifetime

An expired session is removed and rejected when its token is validated.