Approve from your iPhone

kovra Mobile is the free, optional approval app for iPhone. Once you pair it with your Mac, kovra also asks on the phone for the approvals it would show in its review window: you read what the window would show and approve with Face ID. It is the way to approve a request that comes from a Mac you are not sitting at, or one that has no biometrics. 0.12.0 supports iPhone only; Android comes later.

Pair

Install the kovra Mobile app on your iPhone, once it is published.
On the Mac, run:
zsh
```
~ % kovra phone pair
```
kovra prints a QR code and waits up to 5 minutes for the phone to answer.
Scan the QR with the app. Once the phone answers, kovra prints the phone’s name and a 6-digit pairing code, and the app shows its own: compare them.
kovra asks you to approve the pairing at the Mac’s own prompt, naming the phone, the code, the relay’s host and the phone it would replace. The pairing is kept only after you approve it. A remote session cannot pair.

The QR carries a secret the relay never sees, so the relay cannot pair in place of your phone. By default the pairing goes through Kaeus’ relay (relay.kovra.sh); --relay <url> picks another one. The pairing survives restarts of kovrad, the Mac and the phone, and updates of kovra and the app.

What the phone approves

With a phone paired, every approval request goes to the phone as well as to the Mac, with the same text kovra’s window shows and a short request code that the terminal prints. The push notification itself carries no detail.
The first decision wins, and a denial on either side denies. A denial needs no Face ID. An answer that expired, was withdrawn or cannot be verified never approves. If the phone cannot be reached, the request is denied.
Over SSH, or anywhere kovra’s window cannot be shown, the phone alone decides. With no phone paired, those requests are refused.
Muting notifications in the app means no push; the terminal says so, and the request still waits in the app.
Only at the Mac, never on the phone: operations on the master key (kovra key export, kovra init --force), pairing the phone and forgetting it.
Neither the relay nor the push ever sees a secret’s value or the request’s details. Every decision adds an entry to the audit trail saying who decided (approved-on-phone, denied-on-phone, approved-at-mac, denied-at-mac, a timeout, or phone-unavailable), never a value.

See it and forget it

~ % kovra phone status

It shows the paired phone, its relay and whether notifications are on or muted. kovra phone forget asks for your approval at the Mac, then deletes the mailbox on the relay and the pairing; if the relay cannot be reached it tells you so.

Ask kovra preflight phone-pair or kovra preflight phone-forget first if you want to know what they will ask. See Preflight.