FAQ

What does rstream do?

rstream exposes services that run on private networks through publicly reachable endpoints, without requiring inbound ports or public IPs. An agent establishes an outbound connection to the edge network, and the engine relays traffic through tunnels.

Use rstream when the useful object is a service, terminal, device, agent, or private endpoint that opts into access without exposing the surrounding network.

Does rstream require a VPN?

rstream does not require a VPN for the tunnel model. Connectivity is established from the inside using outbound-only links, and access control is enforced at the edge and through tokens.

rstream is service-oriented rather than network-oriented. A VPN usually places a user or workload onto a private network segment. rstream exposes specific tunnels with explicit protocol, authentication, and policy settings. This makes it a better fit for webhooks, temporary development access, device callbacks, browser-facing tools, and application-level integrations where exposing an entire private network is unnecessary.

Is a published tunnel public?

Published means the tunnel has an externally reachable endpoint. It does not mean unauthenticated. Published tunnel entrypoints can require mTLS. HTTP-family published tunnels can also require token authentication, rstream Auth, challenge mode, IP or Geo policy, and project access policy.

Use private tunnels when only native rstream clients may reach the service and no public endpoint is required.

How does remote terminal access work?

WebTTY is the rstream remote-terminal product. A machine runs an outbound rstream webtty server, and operators connect from the CLI, rstream ui, the Dashboard, or a browser integration.

Start with WebTTY for the product model. Use the WebTTY FAQ for terminal-specific questions about lightweight WebTTY tunnels, registered servers, recordings, collaboration, and end-to-end encryption.

What is Workspace Protection?

Workspace Protection is an Enterprise workspace feature that keeps selected protected data decryptable only from trusted browsers, trusted devices, or the Recovery Kit. It is not WebTTY-only. WebTTY uses it for workspace-managed terminal E2E and encrypted recordings, but the workspace key model can protect other sensitive data over time.

Workspace setup, trust, and recovery are documented in Workspace Protection.

Is self-hosted CE the same as hosted Enterprise?

Self-hosted Community Edition is a direct-engine deployment, not hosted Enterprise under another name. It is useful for customer-operated tunnels and direct runtime control, but it does not include the hosted Control plane product modules for Enterprise workspaces, Workspace Protection, registered WebTTY inventory, encrypted recording workflows, managed billing, or hosted audit exports.

See Editions & Plans and Self-Hosted.

What is Integrator Edition?

Integrator Edition is the commercial partner path for integrators, managed service providers, and infrastructure platforms that operate rstream capabilities for their own customers. It can include source access under contract, customer environment deployment rights, white-label options, partner-operated infrastructure, and technical enablement.

It is different from self-hosted Community Edition. CE is a free standalone runtime. Integrator Edition is a contract model for organizations that package, operate, or adapt rstream inside their own service boundary.

What is required to run the CLI?

The CLI needs an engine endpoint and authentication material. Hosted workflows typically use rstream login and then select a project. Stateless workflows that call the Engine HTTP API provide RSTREAM_ENGINE with RSTREAM_AUTHENTICATION_TOKEN. Agent control-channel workflows can use either a token or the RSTREAM_MTLS_CERT_FILE / RSTREAM_MTLS_KEY_FILE pair.

How should tokens be rotated?

Long-lived credentials such as PATs and application credentials can be rotated or revoked in the Dashboard. Short-lived tokens minted from application credentials are designed to be refreshed continuously.

Use application credentials and short-lived tokens for automation where possible. Use project-scoped credentials and resource boundaries when a workload only needs one project or one class of tunnel operation. See Tokens and Fine-Grained Tokens.