Show the desktop

Your user watches their Mac, or uses it, right in your page with no NoMac sign-in, and their agent gets a token for that Mac only.

A link

const { url } = await mac.viewLink({ control: true }); // or watch only: viewLink()
// https://nomac.app/mac/view/...: open it, or put it in an iframe with ?embed=1

• Watch shows the screen live. Control adds the keyboard and mouse.
• One controller at a time: a newer control link takes over, and the one before watches and can take control back.
• Two viewers per Mac at once. Watching never keeps the Mac running, so it still stops at its idle timeout.
• A link lasts 2 hours by default, a day at most, and ends with its Mac. It works for your user's Mac only.

In your page

<iframe src="https://nomac.app/mac/view/...?embed=1"
        style="width: 100%; aspect-ratio: 16 / 10; border: 0"></iframe>

?embed=1 shows only the screen, at any size, without the page's own bar. The desktop streams as video, so it needs a current Chrome, Edge, Safari or Firefox.

A token for their agent

const { token } = await mac.token({ minutes: 120 });

// Your user's agent, with that token only:
const theirs = new NoMac({ token }).mac(mac.id);
const { stdout } = await theirs.run("xcodebuild -list");

An nmm_… token reaches that Mac's commands and jobs, files and file links, screenshot, input, recording, password and view links. It never reaches another Mac, a start, a stop, an extension, your account's list or its price. It lasts 2 hours by default, a day at most.

Take it back

await mac.revokeTokens(); // every token and link of this Mac made so far; the Mac runs on

Open views close within 20 seconds, and new tokens and links work at once. Revoking the API key that made them ends them too. Over REST: DELETE /api/v1/mac/sessions/{id}/token.