Get up and running with Interveon.
To connect a machine to Interveon, you'll need two things: an account on the server and the thin client running on the machine you want to connect.
The Interveon client requires Node.js 22.13 or later. Install it with your operating system package manager or the official runtime installer for your platform.
Remote desktop requires a media encoder, which the thin client downloads automatically on first run. No manual installation is needed. A native binary for your platform is fetched and stored next to the client script; the same setup also fetches ffplay for viewer-microphone playback, so no system media tools are used.
Ask your server administrator for an invite, or sign up if registration is open. Once you have an account, log into the admin panel to find your workspace token — you'll need this to connect your client.
Your workspace token and server URL are all the client needs to authenticate. You can find both in the admin panel under Workspace Tokens.
The Interveon client is a single JavaScript file. Download it and run it with Node.js — no other dependencies required.
curl -fsSL https://interveon.com/downloads/interveon-client.js -o interveon-client.js
node interveon-client.js
If the download is behind a CDN, read /downloads/version and use its downloadUrl field to fetch a cache-busted copy. That URL includes the current bundle's SHA-256.
node interveon-client.js --update
--update downloads the current SHA-versioned bundle, verifies its SHA-256, replaces the installed file atomically, and restarts the background service. It refuses to install a download whose checksum does not match the relay, so an old cached copy cannot be installed silently.
That's it. The client starts a local dashboard where you can configure everything through your browser.
Once the client is running, open the local dashboard:
http://127.0.0.1:7700
From the dashboard you can:
All settings are saved locally and persist across restarts. You can also configure everything via CLI flags if you prefer.
Everything available in the dashboard can also be set via command-line flags:
node interveon-client.js [options] --host <url> Server URL (e.g. https://interveon.com) --token <token> Workspace authentication token --expose <name>:<port> Expose a local port as a tunnel (repeatable) --headless Run without the local dashboard --port <port> Dashboard port (default: 7700) Feature flags (all on by default): --no-terminal Disable remote terminal access --no-desktop Disable remote desktop access --no-files Disable file sharing --lan-discovery Prefer the relay's local address on the same network TURN relay (optional): --turn-url <url> TURN relay server URL --turn-user <user> TURN username --turn-pass <pass> TURN password Background service: --install Install as a background service (starts on boot) --uninstall Remove the background service --restart Restart the background service Integrity: --verify Check this download matches the checksum your relay publishes
Expose format: --expose myapp:3000 proxies to localhost, --expose nas:192.168.1.10:8080 proxies to a LAN device, and appending +tls connects to the upstream over TLS.
Verify a download: run node interveon-client.js --verify to confirm the file matches the checksum your relay publishes, so you know it was not altered in transit.
Same network: add --lan-discovery when the client and the relay share a local network. The client then dials the relay's local address directly instead of routing out to the public address and back. It stays off by default, and it still verifies the relay's certificate, so it falls back to the public address whenever the relay is not found locally.
After configuring your tunnels through the dashboard, install the client as a system service that starts automatically on boot:
node interveon-client.js --install
This creates a native service for your platform — launchd on macOS, systemd on Linux, or Task Scheduler on Windows. The client and media encoder are copied to ~/.interveon/ so you can safely delete the original download. The dashboard remains available at http://127.0.0.1:7700.
Logs rotate automatically at 5 MB and are stored at:
macOS: ~/Library/Logs/Interveon/interveon.log Linux: ~/.local/share/interveon/interveon.log Windows: %APPDATA%\Interveon\interveon.log
To remove:
node interveon-client.js --uninstall
Interveon consists of two components:
All tunnel traffic flows through the relay server. Remote desktop uses WebRTC for peer-to-peer video on WiFi and LAN networks. For restrictive networks (mobile 5G, VPNs, strict firewalls), the system automatically falls back to HTTP frame relay — JPEG frames over TCP through the existing relay infrastructure.
Once connected, the admin panel at interveon.com gives you access to:
Authorization: Bearer ivn_... on any API endpoint.Remote desktop uses WebRTC peer-to-peer video on WiFi and LAN. On mobile networks (4G/5G) and VPNs, symmetric NAT blocks P2P connections. Interveon handles this automatically with a three-tier fallback:
The browser tries P2P first. The client signals its capture state through the data channel, and the browser starts a short video timer only after RTP packets are flowing. If the connection can't deliver video, it silently switches to HTTP relay. No user configuration needed — it just works.
Windows note: Screen capture and input are unavailable when the Windows lock screen or UAC prompt is active. This is a Windows Secure Desktop restriction that affects all third-party remote desktop tools at the application level. The desktop resumes automatically when the user logs back in.
For lower-latency relay on a VPS with UDP support, enable the embedded TURN server in Settings → Remote Desktop. This provides a middle tier between P2P and HTTP relay. Requires UDP port 3478 open in your firewall.
The thin client automatically downloads the latest media encoder on first run — no package managers or manual installation needed. The binary is stored in ./bin next to the client script and used for all screen capture operations.
Each tunnel has a configurable control mode (click the mode button next to the 🖥️ toggle in the tunnel list):
You can also use an external TURN server like coturn:
sudo apt install coturn # Edit /etc/turnserver.conf: realm=example.com listening-port=3478 external-ip=YOUR_VPS_PUBLIC_IP user=interveon:pick-a-strong-password lt-cred-mech no-tls sudo systemctl enable coturn sudo systemctl start coturn
Then in Interveon Settings → Remote Desktop, fill in:
turn:YOUR_VPS_IP:3478interveonEnsure UDP port 3478 is open in your firewall. TURN is only used as a middle tier — WiFi connections always go direct P2P, and HTTP relay handles everything else.
Remote access features (terminal, desktop, file sharing) are controlled at four independent levels:
All four levels must be enabled for a feature to work. This ensures that both the server administrator and the machine owner have explicitly consented.
Interveon supports encrypted backup archives (.ivnk files) containing both databases, configs, and all workspace data. Backups are encrypted with AES-256-GCM — you set the passphrase, and without it the archive is unreadable.
Sensitive credentials (backup passphrase, SFTP password, SFTP private key) are stored in the config file inside a versioned AES-256-GCM envelope with an auto-generated key. Legacy AES-256-CBC values are migrated on startup, and tampered values are rejected rather than silently returned. Existing plaintext credentials are automatically encrypted on next save.
Configure in Settings → Backup & Restore:
.ivnk file to any Interveon install and restore from thereDatabase snapshots use SQLite's VACUUM INTO for atomic captures with no downtime. Selective restores merge into the live database immediately — no restart needed.