---
id: browser-console
title: Browser console
sidebar_label: Browser console
---

An SSH, RDP or VNC session in a browser tab, with no client software to install
and no new port to open on the target machine.

:::info Requires the console feature on your licence
The console is a per-instance feature you enable on a paid plan. Without it, the
Console button is unavailable. See
[Licensing and entitlements](../hq/licensing-and-entitlements.md).
:::

## What you need

- The target server's **agent must be online**. Console traffic travels over the
  connection the agent already holds, so an offline agent means no session.
- `KEY_ENCRYPTION_KEY` set on a self-hosted install, since every credential
  involved is stored encrypted.
- The service you are connecting to listening on the machine itself. It does not
  have to be reachable from anywhere else, because the agent connects to it
  locally.

## Opening a session

From a server's page, choose **Console**, pick the protocol and connect. Vantage
issues a one-time ticket for that session, and the connection is refused rather
than left hanging if the agent is not online.

## Credentials

### SSH

Uses a private key from your [key library](./ssh-keys.md). The key must have had
its private half uploaded; a public key alone cannot open a session.

### RDP and VNC

You type the credentials when you connect. They are encrypted, used once and
discarded, so the next session asks again.

## During and after a session

Closing the tab ends the session. There is no reconnect: opening it again starts
a fresh session.

Opening a console is recorded in the [audit log](./audit-log.md), with who did
it, which server and when. What happens inside the session is not recorded.
There is no session replay or keystroke capture, so if you need that, it has to
come from the target machine itself.

## When it does not work

| Symptom                          | What to check                                                                            |
| -------------------------------- | ------------------------------------------------------------------------------------------ |
| Connects, then closes at once    | The console daemon is unreachable. On a self-hosted install, check that `guacd` is running |
| SSH refuses the key              | The stored key has no private half, or is not assigned to that server                      |
| RDP fails when you retry         | Credentials are used once. Enter them again                                                |
| Hangs, then disconnects          | The agent could not reach the service on the machine, or the session timed out setting up. The audit log records the reason |
| Works locally, fails in production | Your reverse proxy is not forwarding WebSocket connections                               |