Streams and Stream Controls

A stream is what one Omnodex install uploads to the hosted dashboard: its events, encrypted on the machine before they leave it. Each stream has two credentials, and it helps to keep them apart:

Credential	What it does	Who holds it
Connection token (`omx_...`)	Lets the machine upload. It proves nothing about who can read the data.	The machine, and the stream’s owner in Settings
Stream secret	Encrypts the stream’s events. Without it, nobody can read them, Omnodex included.	The machine, and every account the stream is connected to (stored encrypted under that account’s password)

The stream secret was called the sync passphrase in earlier versions. It is not your account password, and Omnodex cannot recover it. If you lose it on every machine and every account, the stream’s data cannot be read again.

One stream can be uploaded from several machines that share its token and secret, and one account can have several streams. See Multiple machines.

Owners and connected accounts

The account that first connects a stream is its owner. Other accounts can connect the same stream if they have its secret. Settings shows the owner on each stream card, and shows the owner how many other accounts are connected.

Only the owner can see or copy the connection token, pause receiving, revoke or rotate. Every connected account can rename, archive or remove the stream from itself, and reveal its stream secret.

Removing a stream from your account never changes who owns it. The owner stays the owner even after removing it, so the stream keeps counting toward the owner’s plan until the owner revokes it.

Stream states and tabs

Settings lists your streams under All, Active, Inactive and Disconnected. Each card shows its states:

State	Applies to	Meaning	Tab
Active		Uploading normally	Active
Receiving paused	Everyone connected	The owner paused receiving, or every account removed the stream	Inactive
Revoked	Everyone connected	The token no longer works; the machine’s uploads stop	Inactive
Stale	Everyone connected	No new data in 14 days	Inactive
Archived	Your account only	Hidden from your dashboard; uploads continue	Inactive
Disconnected	Your account only	You removed it; its data is hidden from you until you reconnect	Disconnected

Actions

Every action that changes more than your own view asks you to confirm first and says how to undo it. The owner-only actions sit at the right of the card.

Remove from my account

Takes the stream off your account and deletes your account’s copy of its stream secret. The machine keeps uploading, and other connected accounts keep their access.

To add it back you need the stream secret, so reveal and copy it first (see The stream secret). Then use Reconnect on the Disconnected tab, or run omnodex connect on the machine.

When the last connected account removes a stream, Omnodex pauses receiving its uploads. If nobody reconnects it within 7 days, it is revoked automatically. Reconnecting before then resumes receiving. Data follows the normal retention for your plan either way.

Pause receiving (owner)

Omnodex refuses the stream’s uploads, for every connected account, within about a minute. Nothing changes on the machine: it keeps recording, and what it records meanwhile uploads when you resume. omnodex status and omnodex sync on the machine say that receiving is paused.

To stop recording or uploading on the machine itself, use the commands in Pausing Recording and Uploads instead.

Revoke authorization (owner)

The connection token stops working at once, so the machine’s uploads stop for everyone. Nobody is removed, ownership does not change and no data is deleted. Connected accounts see the stream as Revoked.

Use it when you no longer use the machine. To bring the machine back, see Authorizing a machine again. To replace a leaked token and keep uploading, rotate it instead.

Rotate token (owner)

Gives the stream a new connection token. The old one stops working at once. You choose how the machine gets the new one:

Mode	How the machine gets the new token	Use it when
Automatically (default)	On its next sync, any machine that proves it holds the stream secret picks up the new token, once per machine, for 7 days	Routine rotation, or the token alone may have leaked
On the machine	You run `omnodex connect --token <new token>` there. Nothing else can hand it over.	The stream secret may also have leaked, or you do not trust an account connected to the stream

Automatic pickup is safe against a leaked token on its own, because the token is not enough: the machine must also prove it has the secret. Accounts connected to the stream also hold the secret, though, so automatic mode does not keep the new token from them. Use On the machine if that matters.

After rotating, the dialog shows the new token and the full command, once. Machines running an older Omnodex, or that miss the 7-day window, need that command. Between the rotate and a machine’s next sync, its live updates to the dashboard pause; they resume as soon as it has the new token.

A revoked stream can also be given a new token here, as On the machine only, since no machine holds a working token to prove itself with.

The stream secret

Click Reveal on a stream card and enter your account password to see and copy its stream secret. On the machine, omnodex status shows where stream-config.json keeps it.

Omnodex checks the secret whenever a stream is connected, reconnected or authorized again. It stores a one-way check value derived from the secret, which cannot be turned back into the secret or the encryption key (see Encryption). If what you enter, or what a machine sends, does not match, Omnodex refuses it instead of quietly switching the stream to a new secret, which would leave every other account unable to read new data.

You will see this as:

Reconnect or Add stream: “That stream secret does not match the one this stream uses.”
omnodex connect on a machine with a token but no secret: it asks you for the stream’s secret instead of generating a new one. Run omnodex connect --secret <stream secret>.
omnodex sync on a machine whose secret is wrong: uploads stop with a message saying so, and omnodex status shows it. Fix it with omnodex connect --secret <stream secret>.

Authorizing a machine again

A machine stops uploading when its stream is revoked (by the owner, or automatically after everyone removed it), or when its token was rotated On the machine. In every case, run on the machine:

omnodex connect

The CLI sees that its token no longer works and starts a sign-in. Open the link, sign in as the stream’s owner and enter the code. Under Connect to, the device page lists your revoked streams and the ones you removed from your account, with the one last seen from this machine already selected. Choose it and click Re-authorize device.

The stream keeps its id, its history and every account connected to it. The machine gets a new token and uploads resume. Choose A new stream only if you want a fresh stream with no history.

If the machine’s stream secret is not the stream’s, the device page says so and gives you two options. You can keep the stream’s secret: reveal it in Settings and run omnodex connect --secret <stream secret> on the machine. Or you can replace the stream’s secret with the machine’s. Replacing means every other connected account must enter the new secret, and data uploaded before the change stays readable only with the old one.

If the token was rotated Automatically, you do not need any of this: omnodex connect or the next sync picks up the new token by itself.

Next steps

Pausing Recording and Uploads: stop capture or uploads on a machine for a while
Hosted Dashboard: connecting machines and keeping them in sync
CLI Commands: omnodex connect and its flags