Browser route

Reach the panel from an address you have allowed. Any one of these works:

• Reach it over a VPN (Tailscale, WireGuard)
• Reach it through an SSH port forward
• Put a TLS reverse proxy in front of it (see trustedProxies)
• Only reach it from the same LAN

If you are on shared hosting and can do none of these, leave the browser route off and use the in-game screen.

Enabling it

config.web.http.enabled = true

Tokens come from convars, and one pair covers every RE : CORD panel at once:

  # every RE:CORD panel
  set REC:adminToken "a-random-string-of-32-chars-or-more"
  set REC:supportToken "another-one-for-read-only-access"

  # this panel only, overriding the shared one
  set REC_PlayerManager:supportToken "a-third-one"

adminToken carries *, supportToken carries read. An empty token makes every /api/* call return 401. A token shorter than 32 characters prints a warning on startup.

For something narrower than those two, add a named token and give it its own convar:

customTokens = {
    { name = "playersOnly", scopes = { "players" }, },
}

  set REC_PlayerManager:token:playersOnly "yet-another-random-string"

allowedAddresses

Requests from an address that is not on this list get 404 — before authentication, so the route stays invisible from the outside. The default allows this machine only.

  # every RE:CORD panel
  set REC:allowedAddresses "192.168.1.0/24"

Or replace the list outright in the config, keeping loopback in it:

allowedAddresses = {
    "127.0.0.0/8",        -- loopback
    "::1",
    -- "100.64.0.0/10",   -- Tailscale (CGNAT range)
    -- "192.168.1.0/24",  -- LAN
    -- "172.18.0.0/16",   -- Docker bridge
}

Entries are IPv4 CIDR blocks or literal addresses. IPv6 has no CIDR support, so write the address in lowercase canonical form. An entry that can never match is reported on startup.

trustedProxies

Behind a reverse proxy every request arrives from the proxy itself, so the address check can no longer see the real client. Register the proxy instead:

trustedProxies = {
    "127.0.0.1",
}

Requests from a registered proxy skip the address check, which means access control becomes the proxy's job — configure authentication there (Caddy basic_auth, nginx allow / deny, Cloudflare Access). X-Forwarded-For is only written to the debug log, never used to authorise, because any client can forge it.

Common setups

Endpoints

Everything under /api/* needs the address check and a token carrying the scope. A token that passes the address check but not the scope gets 403 rather than 404: the route exists, your token is just not allowed to use it. Every POST also needs readOnly to be off.