# Smartphone remote

```bash
npx recit dev slides.md --remote
```

The terminal prints a QR code: scan it with a phone on the same network to go forward, back, and
read your notes. Press **R** in the deck to show the QR code again. The server listens on the local
network only with `--remote` (or `--host`).

Two separate tokens protect it, and they are needed for **every** route, not only the remote one:
from the machine itself nothing is asked, but a browser on the network gets nothing — not the deck,
not its media, not the live-reload stream — without a token. The terminal prints the link that
carries the screen's token; the QR code carries the phone's. A phone that is passed around can drive
the deck, never take the screen's place. The token travels once in the URL, then in a `HttpOnly`
cookie.