Managing Peers

Each issuer keeps an allowlist of the devices that may connect to it. Pairing adds a device to it, and nothing else does unless you edit the file yourself.

Listing peers

rex-iroh peers list
# 695cc6e6d2  Isaac's Pixel 8       paired 2026-11-12  1 connection
# 0f1e2d3c4b  Work laptop           paired 2026-10-30  1 connection

Revoking a peer

rex-iroh peers revoke "Work laptop"
# revoked Work laptop (0f1e2d3c4b); closing 1 connection(s)

You can name the device by its exact label, its full endpoint id, or the start of its id, as long as that start matches only one device. If serve is running, the device’s open connections close right away, cutting off any session in progress.

Editing the allowlist by hand

The allowlist is a plain text file, by default allowlist in the state directory, the directory where rex-iroh keeps this device’s key and settings. (If you start serve with --allowlist pointing somewhere else, note that peers list and peers revoke still read the default file when serve isn’t running.) It has one endpoint id per line, and # starts a comment. Pairing writes each device as a comment with its label and the date, followed by its id:

# Isaac's Pixel 8, paired 2026-11-12
695cc6e6d2fedb02b93852baf30a0023e7d3ab2e315cd10a650b079889dd24a8

You can add, remove and annotate lines yourself. A running serve checks the file every two seconds, so there’s no need to restart it. Removing a line has the same effect as peers revoke: that device’s connections close.

If an edit leaves any line unreadable, for example an id with a typo, serve ignores the whole edit, logs a warning naming the line, and keeps using the last version that worked. That means a device you removed in the same edit can still connect. serve saves each version that worked as allowlist.bak, so the same holds if the file breaks while serve is stopped. While the file is unreadable, peers list and peers revoke fail with an error naming the bad line, so running peers list after an edit is a quick way to check it.

To add a device without pairing, put its endpoint id in the file. The device can print its id with rex-iroh id. You then need to get the issuer’s ticket to that device yourself, since pairing is what normally hands it over. serve prints the ticket when it starts.

On the joiner

A joiner keeps the ticket of each issuer it has joined in the peers directory of its state directory, in a file named after the issuer, as given to join --host. These are the devices it can connect to, not ones that can connect to it, so peers list on a joiner doesn’t show them. peers joined does:

rex-iroh peers joined
# HOST        ID          SOCKET
# desktop     c33be3af42  /home/you/.local/share/rex-iroh/sockets/desktop-695cc6e6d2.sock

Files saved before issuers had names are named after the issuer’s full id. They still work, under the issuer’s short id; joining that issuer again renames the file.

To stop reaching an issuer, forget it:

rex-iroh forget desktop
# removed desktop (c33be3af42)
# removed this device's endpoint from Rex host desktop (1 endpoint left)
# removed its socket

That also takes this device’s socket off the issuer’s Rex host, or removes the host if nothing else is left on it.

To rename an issuer, join it again with a new --host, which moves this device’s socket to the Rex host of the new name. Deleting or renaming a file by hand works for connect, but leaves this device’s socket on the old Rex host; rex-iroh forget <old name> takes it off.

None of this affects the issuer, which keeps the device on its allowlist until it’s revoked there.