LLLanyard

Guides

Connect your own devices with LLLanyard Pro

With Pro, one of your machines holds your real API keys, and up to 3 of your other devices, such as a laptop, use them through it. No keys are stored on the other devices, so losing a laptop never means losing a key. Everything stays on your own machines and network.

Pro is for one person's own devices. To share with other people, see sharing with your team.

Before you start

Pick the key machine: one that's usually on, such as a desktop or a Mac mini. On it:

npm install -g @lllanyard/cli      # Node 22 or later
lllanyard license activate lly1.…   # your Pro licence key
lllanyard add anthropic             # hidden prompt; add each key you use
lllanyard add openai

Install LLLanyard on each of your other devices too (npm install -g @lllanyard/cli). It doesn't need a licence or any keys there: it pairs the device with the key machine.

Then choose how your devices reach the key machine:

Route A: Tailscale

  1. Install Tailscale on the key machine and on each device, signed in to the same account.
  2. In the Tailscale admin console, under DNS, turn on MagicDNS and HTTPS Certificates. Note the key machine's full name, such as mymac.tail1234.ts.net.
  3. On the key machine, get a certificate for that name: 
    mkdir -p ~/.lllanyard/tls && cd ~/.lllanyard/tls
tailscale cert mymac.tail1234.ts.net
chmod 600 mymac.tail1234.ts.net.key
    On a Mac with the Tailscale app, the command is /Applications/Tailscale.app/Contents/MacOS/Tailscale. These certificates last 90 days: run the same command again to renew, then restart LLLanyard.
  4. Start the shared proxy, listening on the Tailscale address only, so nothing else on your network can reach it: 
    lllanyard serve --host $(tailscale ip -4) --port 3443 \
  --tls-cert ~/.lllanyard/tls/mymac.tail1234.ts.net.crt \
  --tls-key ~/.lllanyard/tls/mymac.tail1234.ts.net.key \
  --allow-host mymac.tail1234.ts.net

Your devices use https://mymac.tail1234.ts.net:3443. Skip to pair each device.

Route B: a self-signed certificate

  1. Give the key machine a fixed address on your network, so the certificate keeps matching it. Either reserve its IP address in your router (for example 192.168.1.20), or use its local name. On a Mac, that's under System Settings → General → Sharing → Local hostname, such as mymac.local.
  2. On the key machine, make the certificate. Put in your own name and address: 
    mkdir -p ~/.lllanyard/tls && cd ~/.lllanyard/tls
openssl req -x509 -newkey rsa:2048 -nodes -days 825 \
  -keyout key.pem -out cert.pem -subj "/CN=mymac.local" \
  -addext "subjectAltName=DNS:mymac.local,IP:192.168.1.20" \
  -addext "extendedKeyUsage=serverAuth"
chmod 600 key.pem
    key.pem is the private half: it never leaves the key machine. cert.pem is the public half that your devices need. It lasts 825 days, the longest Apple devices accept.
  3. Start the shared proxy, allowing both the name and the address: 
    lllanyard serve --host 0.0.0.0 --port 3443 \
  --tls-cert ~/.lllanyard/tls/cert.pem --tls-key ~/.lllanyard/tls/key.pem \
  --allow-host mymac.local --allow-host 192.168.1.20
  4. Copy cert.pem to each device, for example as ~/lllanyard-cert.pem. You'll give it to LLLanyard when you pair the device.

Your devices then use https://mymac.local:3443 (or the IP address). Never switch certificate checks off instead, for example with NODE_TLS_REJECT_UNAUTHORIZED=0: anything on the network could then pose as your key machine.

Pair each device

Pro allows 3 devices. On the key machine, make a pairing code for the device:

lllanyard device add work-laptop

The code works once, for 10 minutes. On the laptop, pair it with the key machine's address. It asks for the code:

lllanyard device join https://mymac.tail1234.ts.net:3443
# Route B: add the certificate you copied
lllanyard device join https://mymac.local:3443 --ca ~/lllanyard-cert.pem

The pairing only works on that laptop. LLLanyard ties it to the laptop's machine ID, so it can't be copied to another computer. Check it with lllanyard device status, and see all your devices on the key machine with lllanyard device list.

Run scripts and tools on the device

Put --remote after exec:

lllanyard exec --remote pwsh -File ./Deploy-App.ps1
lllanyard exec --remote python3 sync.py
lllanyard exec --remote --keys github -- gh repo list

As on the key machine, LLLanyard reads the script to see which keys it uses, and passes only those. The key machine sends them for that run only. They are kept in memory, never saved on the device, and any that appear in the output are redacted. When the command finishes they're gone, and the next run asks again. lllanyard usage on the key machine shows which device fetched which keys, for which command.

To keep a device from ever receiving a key, pair it with lllanyard device add tablet --no-keys. Its tools then go through the key machine instead, as with the relay below.

Apps that stay open, such as an editor

For an AI tool or app you don't start from the command line, run the relay on the device:

lllanyard relay

It prints a local address and a token for this device. Point the app at that address, for example ANTHROPIC_BASE_URL=http://127.0.0.1:3000/anthropic, and use the token as its API key. The relay passes each request on to the key machine, which adds the real key, so the key never reaches the device at all. The token only works through the relay on that device.

Keep the key machine running

On a Mac, start LLLanyard at login with a launch agent. Find the paths with which node and which lllanyard, then save this as ~/Library/LaunchAgents/app.lllanyard.serve.plist, with your own paths and serve options:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>app.lllanyard.serve</string>
  <key>ProgramArguments</key><array>
    <string>/opt/homebrew/bin/node</string>
    <string>/opt/homebrew/bin/lllanyard</string>
    <string>serve</string>
    <string>--host</string><string>0.0.0.0</string>
    <string>--port</string><string>3443</string>
    <string>--tls-cert</string><string>/Users/you/.lllanyard/tls/cert.pem</string>
    <string>--tls-key</string><string>/Users/you/.lllanyard/tls/key.pem</string>
    <string>--allow-host</string><string>mymac.local</string>
  </array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
  <key>StandardOutPath</key><string>/dev/null</string>
  <key>StandardErrorPath</key><string>/Users/you/.lllanyard/serve-errors.log</string>
</dict></plist>

Load it with launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/app.lllanyard.serve.plist. Usage is still recorded for lllanyard usage. If macOS asks whether node may accept incoming connections, allow it.

Stop it sleeping: under System Settings → Energy (or Battery → Options on a laptop), turn on Prevent automatic sleeping when the display is off and Wake for network access. A laptop works as the key machine only while it's awake and plugged in.

On Windows, in PowerShell as administrator, let your devices in on private networks only, then start LLLanyard at sign-in:

New-NetFirewallRule -DisplayName "LLLanyard" -Direction Inbound -Protocol TCP -LocalPort 3443 -Profile Private -Action Allow
schtasks /create /tn "LLLanyard" /sc onlogon /tr "cmd /c lllanyard serve --host 0.0.0.0 --port 3443 --tls-cert %USERPROFILE%\.lllanyard\tls\cert.pem --tls-key %USERPROFILE%\.lllanyard\tls\key.pem --allow-host mypc.local"

Then under Settings → System → Power, set sleep to Never when plugged in.

If a device is lost

On the key machine, run lllanyard device remove work-laptop. It stops working within about 10 seconds, and its place is free for another device. Your real keys don't need changing, because none were stored on it.

More guides