Connect your phone to Kiro Crew (Windows)
Part 2 of Kiro Crew on Windows (install + CLI + Builder ID). The dashboard is localhost:5476—your phone cannot open that. Crew’s official path uses Tailscale Serve (HTTPS inside your private tailnet), guided from the UI.
This is not Telegram/Slack, and not a public Cloudflare/ngrok tunnel. There is no Kiro Crew app on iPhone or Android.
1. Overview
- PC: Connect your phone → Finish setup → install/sign in Tailscale → enable HTTPS if asked → Set up & show QR.
- Phone: install Tailscale → allow VPN → sign in (same account)—not the Crew QR.
- With Tailscale connected on the phone, scan the Crew QR (or open the token link).
- Keep the PC awake; laptop sleep = phone offline.
2. Prerequisites
- Part 1 done: Crew desktop up (All systems running on Overview).
- Phone (iOS or Android) that can install Tailscale.
- Browser for Tailscale sign-in / admin when prompted.
3. Open Connect your phone
- Crew sidebar → Connect your phone.
- Dialog Use Kiro Crew on your phone. If remote access is not ready: Remote access is not set up yet. Finish setup to get a scannable code.
- Click that row (Finish setup).
That only opens Settings → Overview. It does not install Tailscale or show a QR yet. Crew’s dialog says “scan with your camera”; it does not spell out Tailscale-on-phone—do that before the Crew QR (step 6).
4. Install Tailscale on the PC
Overview may show Setup needed / Download Tailscale. Use Crew’s button, or the official stable installer:
https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe
Prefer the browser (Save link / open the URL), or Windows curl.exe:
curl.exe -L "https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe" -o "$env:USERPROFILE\Downloads\tailscale-setup-latest.exe"
Start-Process "$env:USERPROFILE\Downloads\tailscale-setup-latest.exe"
- Agree to the license → Install (UAC).
- Installation Successfully Completed → Close.
- Welcome to Tailscale → Get Started.
- Join your network → Sign in to your network (browser SSO). Same account you register with. Web Machines stays empty until the PC app finishes sign-in—use the app, not Add first device in the admin console.
- Browser Connect device (PC name → your tailnet) → Connect. (No screenshot—page shows account and hostname.)
- Connect to your tailnet devices → Close (tray icon manages Tailscale day to day).
- Confirm the PC under Machines.
Tailscale Personal is free for this (PC + phone = user devices). Prefer Serve (private) over Funnel (public).
5. Enable HTTPS (one-time)
MagicDNS is usually already on. HTTPS Certificates often need a one-time enable:
- Open DNS.
- Confirm MagicDNS is enabled (button reads Disable MagicDNS…).
- HTTPS Certificates → Enable HTTPS… → Enable.
- The dialog warns that cert names (e.g.
machine-name.tail….ts.net) go in a public Certificate Transparency ledger—normal for Let’s Encrypt; Serve still stays inside your tailnet. - Crew Overview → Re-check.
6. Set up & show QR (PC), then phone
Overview card: Phone access · Setup needed — allow access by this computer’s network name — Set up & show QR / Re-check.
- If HTTPS still blocks the card, finish §5 → Re-check.
- Set up & show QR once (Windows may need elevation for Tailscale Serve).
Crew enables Tailscale origin, restarts the Gateway, runs Serve (443 → local dashboard), and shows a short-lived sign-in QR. Do not screenshot or publish that QR—it embeds a live session token.
Phone (iOS or Android)—Tailscale first, Crew QR second:
- Install Tailscale (App Store / Play Store).
- Allow VPN / VPN configuration when asked.
- Sign in with the same account as the PC. Tailscale does not use the Crew QR for this step.
- Leave Tailscale connected.
- Scan the Crew QR with the system Camera (or open the
https://…/?token=…link in the mobile browser). Mint a fresh QR if the old one expired. - Dashboard loads. Optional: Add to Home Screen (PWA).
Do not open the bare MagicDNS hostname without a token. Create sign-in link in the first Crew dialog is a fallback after remote access works—it does not replace Tailscale.
7. CLI alternative (desktop install)
The Setup.exe build does not put kirocrew on PATH. Use the bundled CLI if the UI sticks (Admin PowerShell if Serve needs elevation):
$kc = "$env:LOCALAPPDATA\Programs\KiroCrew\resources\backend-dist\kirocrew-backend\bin\kirocrew.cmd"
& $kc config set dashboard.tailscale.enabled true
& $kc restart
& $kc tailnet up
& $kc token
& $kc tailnet status
| Command | Role |
|---|---|
… enabled true |
Trust Tailscale Serve origin (once) |
tailnet up |
Publish HTTPS → dashboard (URL alone has no session) |
token |
Prints https://…/?token=… for the phone |
& $kc tailnet down stops publishing without clearing the enabled flag.
8. Sessions
| Piece | Typical duration | Notes |
|---|---|---|
| QR / link click window | Minutes | Mint again if stale |
| Access cookie | Up to ~20h | Short-lived access |
| Refresh cookie | ~30 days idle | Phone can stay signed in |
Config: %USERPROFILE%\.kiro\crew\.
9. Summary
1. Part 1: Crew + kiro-cli on Windows
1. Connect your phone → Finish setup → Tailscale on PC → Connect
1. Admin DNS: Enable HTTPS → Re-check
1. Set up & show QR
1. Phone: Tailscale + VPN + same account → then scan Crew QR
curl.exe -L "https://pkgs.tailscale.com/stable/tailscale-setup-latest.exe" -o "$env:USERPROFILE\Downloads\tailscale-setup-latest.exe"
Start-Process "$env:USERPROFILE\Downloads\tailscale-setup-latest.exe"
10. Troubleshooting
| Issue | Fix |
|---|---|
| Finish setup “does nothing” | It only opens Overview—install Tailscale next |
| Failed to fetch / gateway stuck on :5476 | Restart PC; confirm Overview loads |
kirocrew not found in PowerShell |
Expected for Setup.exe—use bundled kirocrew.cmd path in §7 |
| Card stays Setup needed | PC Tailscale signed in; HTTPS enabled; Re-check |
| Crew QR scan does nothing | Tailscale connected on phone first; use Camera/Safari/Chrome; mint a fresh QR |
| Phone login screen only | Open token/QR URL, not bare hostname |
| Serve permission error | Admin PowerShell for tailnet up
|
| Laptop sleep | Keep PC awake or use an always-on host later |
Top comments (0)