<SYSTEM>This is the full developer documentation for IZT Blink Docs</SYSTEM>

# IZT Blink Docs

> Set up Blink, support the people who rely on you, and fix problems fast. Step-by-step guides for technicians and administrators.

IZT Blink lets your technicians help people on their own computers. Run a **Support** session with a one-time code when someone is there to let you in, or connect to the computers you manage with **Access**, even when nobody is at the keyboard. These guides cover both, on Blink Cloud and on your own server.

## Find your way

[Section titled “Find your way”](#find-your-way)

Get started

What Blink is, first sign-in, activating your license, and your first Support session and Access device.

[Get started →](/get-started/)

Install

Set up Blink on your own server, give it a trusted certificate, and put Blink on the computers you support.

[Install Blink →](/install/)

Configure

Users, organizations, roles, groups, sign-in security, alerts, and your license.

[Configure Blink →](/configure/)

Use Blink

Support and Access sessions, the viewer and its tools, recordings, and session history.

[Use Blink →](/use/)

Troubleshooting

Symptoms and fixes for the problems technicians run into most.

[Troubleshooting →](/troubleshooting/)

## Popular tasks

[Section titled “Popular tasks”](#popular-tasks)

[Install the Access agent on Windows](/install/access-agent-windows/)Put Blink on a computer you manage, with the installer, a command line or from a support session.

[Run your first Support session](/get-started/first-support-session/)Create a code, get your customer connected, take control and end the session.

[Fix a browser certificate warning](/troubleshooting/certificate-warning/)Give your Blink address a certificate browsers trust.

[Fix an agent that will not connect](/troubleshooting/agent-wont-connect/)Get a support tool or Access device connected when it stays on Connecting or shows as offline.

Can’t find what you need? Ask the AI assistant. Its answers come from these docs, with links to the pages they used.

# 404

> We couldn't find that page. It may have moved, been renamed, or never existed. Search the docs or jump to a section below.

Looking for something specific?

Press **Ctrl K** (**⌘ K** on Mac) anywhere in the docs to search every page, or ask the AI assistant and it will find the right page for you.

## Jump to a section

[Section titled “Jump to a section”](#jump-to-a-section)

Get started

[Get started →](/get-started/)

Install

[Install Blink →](/install/)

Configure

[Configure Blink →](/configure/)

Use Blink

[Use Blink →](/use/)

Troubleshooting

[Troubleshooting →](/troubleshooting/)

If you reached this page from a link in the docs, please [let IZT know](https://izt.app) so we can fix it.

# Configure

> Set IZT Blink up for your team: users, organizations, roles, groups, security settings and instance settings.

This section covers setting Blink up for your team in the Blink console: who can sign in, what they can reach, and the settings that apply across your whole server.

## Where settings live

[Section titled “Where settings live”](#where-settings-live)

The console sidebar groups settings by how far they reach:

* **Organization**: settings for the organization you are working in. **Team**, **Groups**, **Roles**, **Enrollment** and **Organizations**.
* **Instance**: settings for your whole Blink server and every organization on it. **Users**, and **Instance** with its tabs **Roles**, **Organizations**, **Settings**, **License**, **Identity**, **Certificates**, **Security**, **Diagnostics** and **Activity**.
* **You**: your own **Account**, with your two-factor setup and passkeys.

You only see the pages and tabs your permissions and your plan allow.

## People and access

[Section titled “People and access”](#people-and-access)

* [Add and manage users](/configure/users/): create accounts, send invite links, give roles, disable users and reset sign-in.
* [Manage organizations and teams](/configure/organizations/): one organization per customer, and who is on each team.
* [Roles and permissions](/configure/roles/): the Owner role, the starter roles, custom roles and every permission.
* [Limit access with groups](/configure/groups/): give people access to some devices only.
* [Sign-in and two-factor authentication](/configure/sign-in-and-two-factor/): authenticator apps, passkeys, recovery codes and signing out everywhere.

## Security

[Section titled “Security”](#security)

* [Security settings](/configure/security-settings/): join-code format, sign-in lifetime, high-risk confirmations, fleet limits, rate limits, bans, trusted networks and the Support session timeout.
* [Restrict access by IP address and country](/configure/ip-and-country-rules/): limit where the console can be used from and where each organization’s Access devices connect from.
* [Owner alerts and webhooks](/configure/alerts/): security alerts in the console and in your chat or monitoring tool.

## Instance settings

[Section titled “Instance settings”](#instance-settings)

* [Choose the name customers see](/configure/technician-name/): how the Support banner names your technicians.
* [Recording storage and log levels](/configure/recordings-and-logs/): retention of recordings and logs, and turning up an agent’s logging.
* [HTTPS certificates](/configure/certificates/): what the Certificates page does.
* [Understand your plan and its limits](/configure/plans-and-limits/): Blink Core and Blink Pro, technician seats, Access devices and what changes when your plan does.
* [Check and renew your license](/configure/license/): license status, renewal, grace and lapse.

## A typical setup order

[Section titled “A typical setup order”](#a-typical-setup-order)

1. [Create your organizations](/configure/organizations/#create-an-organization), one per customer.
2. Decide on roles. The starter roles **Admin**, **Technician** and **Viewer** cover most teams; [create custom roles](/configure/roles/#create-a-role) where they don’t.
3. [Create users](/configure/users/#create-a-user-and-send-an-invite) and give them roles.
4. If some people should only reach some devices, [set up groups](/configure/groups/).
5. Review the [security settings](/configure/security-settings/), add your office network to the [allowlist](/configure/security-settings/#allowlist), and set up an [alert webhook](/configure/alerts/#send-alerts-to-a-webhook).
6. If the console or your Access devices should only be reachable from known networks, [set up IP and country rules](/configure/ip-and-country-rules/). Add your own office or VPN address first.

For installing Blink, activating your license and enrolling devices, see [Install](/install/).

Note

Can’t find what you need? Ask the AI assistant or contact [IZT](https://izt.app).

# Owner alerts and webhooks

> See security alerts in the console and send them to a chat tool or monitoring system with a webhook.

Blink alerts your instance owners to events that may mean a console account has been misused. Alerts show in the console and, if you set one up, are also sent to a webhook.

## What raises an alert

[Section titled “What raises an alert”](#what-raises-an-alert)

* A fleet limit was reached: someone tried to start more Access sessions, reboots or chats with devices’ users in an hour than allowed. See [Fleet limits](/configure/security-settings/#fleet-limits).
* A new instance owner, a new instance role assignment, or a new organization Owner. Removing an instance owner raises an alert too.
* An instance owner reset someone’s password, two-factor and passkeys.
* Role and access changes: roles created, changed or deleted, members’ roles changed, group roles given or removed, and instance role assignments changed or removed.
* A wrong passkey or code entered to confirm a high-risk action.
* An organization’s Access device was refused by the organization’s agent IP rule (**Agent blocked by IP rule**). Blink raises it at most once per organization per day. Refusals by the console IP rule are recorded in the activity log but not alerted. See [Restrict access by IP address and country](/configure/ip-and-country-rules/).
* The console IP rule was cleared outside the console to get a locked-out team back in (**Console IP rule cleared**).
* Security changes that could silence other alerts: the alert webhook set or removed, the high-risk confirmation setting loosened, or a fleet limit loosened.
* An Access device could not enroll because your plan’s device limit is reached. The alert is titled **Device limit reached**, and people with the **View license** permission get an **Open License** link with it. The activity log records it as **Enrollment refused: device limit reached**, at most once an hour. See [Access devices](/configure/plans-and-limits/#access-devices).

Every alert is also a record in the activity log, which stays the complete history of who did what.

## See alerts in the console

[Section titled “See alerts in the console”](#see-alerts-in-the-console)

Instance owners see a bell icon at the top of the console. A number on it shows unread alerts.

1. Select the bell to open **Alerts**.
2. Read the list. The newest alerts are at the top.
3. Select **Mark all read** to clear the count, or **Instance activity** to open the full activity log.

An **Agent blocked by IP rule** alert has an **Open agent IP rules** link to the rule, shown while that organization is the one selected and you have the **View agent IP rules** permission.

Alerts are kept for 90 days. If the same person repeatedly hits a fleet limit or enters a wrong confirmation code, Blink shows one alert per hour for it; every attempt is still in the activity log. A device refused at the device limit is different: Blink records it in the activity log, and raises the alert, at most once an hour for the whole server, however many devices are refused.

Note

Only instance owners see the bell. To give other people a view of what happens, use the **Activity** page (organization activity, with the **View activity** permission) or **Instance** › **Activity** (with the **Instance activity** permission).

## Send alerts to a webhook

[Section titled “Send alerts to a webhook”](#send-alerts-to-a-webhook)

A webhook sends each alert to another system as it happens, for example a team chat channel or your monitoring tool. You need the **Manage security settings** permission.

1. Open **Instance** › **Security**.
2. Under **Owner alerts**, enter the **Webhook URL**.
3. Select **Save webhook**.
4. Select **Send a test** to check that the alert arrives.

The URL must use `https` (plain `http` is accepted only for an address on the Blink server itself) and can’t contain a user name or password. Blink keeps it encrypted and shows only its host name afterwards, because the URL may contain a token. To change it, enter a new URL under **Replace the webhook URL**. To stop sending alerts, select **Remove**.

Caution

Setting or removing the webhook raises an alert itself, so a removed webhook can’t go unnoticed.

### What the webhook receives

[Section titled “What the webhook receives”](#what-the-webhook-receives)

Blink sends an HTTP `POST` with a JSON body like this:

```json
{
  "type": "blink.alert",
  "instance": "<your server's instance id>",
  "id": "<alert id>",
  "at": "2026-11-11T09:30:00Z",
  "kind": "new_admin",
  "title": "<short title>",
  "detail": "<one-sentence description>",
  "actor": "<email of the person who did it>",
  "action": "<the activity log action>",
  "text": "<title>: <detail>"
}
```

The `text` field is the title and detail in one line, which most chat tools show as is. `actor` and `action` are left out when they are empty. The `kind` is one of:

| Kind               | Meaning                                                                                                                                       |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| `mass_action`      | A fleet limit refused someone                                                                                                                 |
| `new_admin`        | A new instance owner, instance role assignment or organization Owner                                                                          |
| `mfa_reset`        | An instance owner reset an account’s password and two-factor                                                                                  |
| `role_change`      | Roles, members’ roles, group roles or instance role assignments changed, or an instance owner removed                                         |
| `sudo_failed`      | A wrong code or passkey when confirming a high-risk action                                                                                    |
| `security_change`  | The webhook was set or removed, high-risk confirmations or fleet limits were loosened, or the console IP rule was cleared outside the console |
| `device_limit`     | An Access device could not enroll because the plan’s device limit is reached                                                                  |
| `ip_blocked_agent` | An organization’s agent IP rule refused an Access device                                                                                      |
| `test`             | A test sent with **Send a test**                                                                                                              |

The webhook must answer with a `2xx` status within 10 seconds. Blink does not follow redirects. If **Send a test** fails, the console only says that it failed; the reason is in the server log.

# HTTPS certificates

> Where to manage the HTTPS certificates your Blink console uses, and what they do and don't affect.

The HTTPS certificate is what lets browsers trust your Blink console’s address. You manage certificates on **Instance** › **Certificates**. You need the **Certificates** instance permission.

## On Blink Cloud

[Section titled “On Blink Cloud”](#on-blink-cloud)

Blink Cloud sets your Blink address and issues and renews its certificates for you. The **Certificates** page shows them as **Managed by Blink Cloud**, and there is nothing to configure.

## On your own server

[Section titled “On your own server”](#on-your-own-server)

The **Certificates** page offers three sources:

* **Let’s Encrypt**: free certificates, issued and renewed automatically for the domains you list. The domains must point to your server.
* **Uploaded certificates**: a certificate from your own provider or private certificate authority. An uploaded certificate wins over Let’s Encrypt for the names it covers.
* **Built-in certificate**: served to IP addresses and every name not covered above. Browsers don’t trust it, so give your console address a real certificate.

The **Served names** card shows which certificate each host name gets right now.

If you use Blink View, customers’ phones open your Blink address too, so give it a Let’s Encrypt certificate or upload one from a public certificate authority; otherwise phones show a certificate warning. See [Fix Blink View problems](/troubleshooting/blink-view/#the-phone-shows-a-certificate-warning).

For step-by-step setup, see [Install](/install/).

## Certificates and agents

[Section titled “Certificates and agents”](#certificates-and-agents)

Agents don’t depend on the console’s certificate. They check your server’s identity in a separate way, so changing, renewing or replacing a certificate never disconnects agents.

Note

Uploading a certificate and key for your console’s address is a powerful permission: whoever holds it could impersonate your sign-in page. That is why **Certificates** is a separate permission from **Instance settings**.

# Limit access with groups

> Put devices into groups and give people a role on one group, so they reach only those devices.

A group is a set of devices within one organization, for example a site, a department or a set of servers. Groups let you give someone access to some devices without giving them access to the whole organization.

The **Groups** page lists the current organization’s groups. Select a group to see its devices and who has a role on it.

## How group access works

[Section titled “How group access works”](#how-group-access-works)

* A role given on the **Team** page applies to every device in the organization.
* A role given on a group applies only to the devices in that group.
* Someone who should reach only certain groups joins the team as **Member (group access only)**, with a role on each group they need.
* A person’s permissions add up: their organization-wide role plus every group role they hold.

Organization-wide permissions in a role (members, groups, enrollment, roles, organization and activity) don’t apply within a group. The **Owner** role can’t be given on a group.

## Create a group

[Section titled “Create a group”](#create-a-group)

You need the **Create groups** permission.

1. Open **Groups** and select **New group**.
2. Enter a **Name**, for example `Front office`.
3. Select **Create group**.

Devices join a group through an enrollment key made for that group, or when someone with the **Edit devices** permission moves them into it. See [Install](/install/) for enrollment keys.

## Give someone a role on a group

[Section titled “Give someone a role on a group”](#give-someone-a-role-on-a-group)

You need the **Manage group access** permission. The person must already be an active member of the organization. If they aren’t, add them on the **Team** page first, as **Member (group access only)** if they should only reach groups. See [Manage organizations and teams](/configure/organizations/#add-a-member).

1. Open **Groups** and select the group.
2. Under **Group roles**, select **Give a role**.
3. Choose the **Member**.
4. Choose the **Role on this group**.
5. Select **Give role**.

To take a group role away, select the bin icon on the member’s row under **Group roles**.

Instance administrators can also give a group role from the **Users** page, with the scope **One group in one organization**. That adds the person to the organization as **Member (group access only)** if needed. See [Add and manage users](/configure/users/#give-a-user-a-role).

Tip

If a group shows **No group roles**, only people with an organization-wide role can reach its devices.

## Rename or delete a group

[Section titled “Rename or delete a group”](#rename-or-delete-a-group)

* To rename, select the group, then **Rename**. You need the **Edit groups** permission.
* To delete, select the group, then **Delete**, and confirm with **Delete group**. You need the **Delete groups** permission.

Deleting a group removes every role given on it. Its devices stay enrolled; they just leave the group.

# Restrict access by IP address and country

> Limit where the console can be used from, and where each organization's Access devices may connect from, with lists of IP ranges and countries.

IP and country rules decide which networks may reach Blink. There are two kinds:

* **The console rule**, on **Instance** › **Security**, decides where the console can be used from: sign-in, the API and live viewing. When it has entries, it applies to every user, the Owner included.
* **An agent rule** for each organization, on the **Organizations** page, decides where that organization’s Access devices may connect from: their connection to the server, Access sessions, terminals and enrollment.

Your customers are never restricted when they join a Support session, and Support sessions are never restricted by an agent rule.

## How a rule works

[Section titled “How a rule works”](#how-a-rule-works)

A rule is a list of entries. Each entry is one of:

* **IP range**: an IPv4 or IPv6 address, or a network written with its prefix length, for example `198.51.100.0/24` or `2001:db8::/48`. A single address counts as its own range.
* **Country**: a country, chosen from the list.

A connection is allowed when its address matches any entry. A rule with no entries restricts nothing, so every address is allowed.

* A rule holds at most 100 entries.
* Each entry can carry a **Note** of up to 200 characters, such as the office or VPN it belongs to.
* Private and local addresses (such as `10.0.0.0/8`, `192.168.0.0/16` or `127.0.0.1`) have no country, and neither has an address the country data doesn’t know. They only match **IP range** entries.

## Who can see and change the rules

[Section titled “Who can see and change the rules”](#who-can-see-and-change-the-rules)

| Rule                          | To see it                  | To change it                 |
| ----------------------------- | -------------------------- | ---------------------------- |
| Console rule                  | **View security settings** | **Manage security settings** |
| Agent rule of an organization | **View agent IP rules**    | **Manage agent IP rules**    |

The starter **Admin** role includes both agent IP rule permissions. See [Roles and permissions](/configure/roles/).

Saving a rule is a high-risk action, so Blink may ask you to confirm with a passkey or code. See [Confirming high-risk actions](/configure/security-settings/#confirming-high-risk-actions).

## Set the console rule

[Section titled “Set the console rule”](#set-the-console-rule)

1. Open **Instance** › **Security** and find the **IP and country rules** card, below **Sign-in**.

2. Check the line **You are connecting from**: it shows your current address and its country. Select **Add my address** to add it as an entry, with the note **Added from my address**.

3. To add another entry, choose **IP range** or **Country**:

   * For an IP range, enter the **Address or network**, for example `198.51.100.0/24`.
   * For a country, pick it under **Country**.

4. Optionally enter a **Note**, such as `Office VPN`, and select **Add**.

5. Repeat for each network your team works from. To take an entry out, select the cross (**Remove**) at the end of its row. You can change a note in the **Note** column at any time.

6. Read the line under the list, which tells you what saving does (see below), then select **Save rule**. **Discard** throws away your unsaved edits.

The pill in the card’s header shows how many entries the saved rule has, or **Not restricted** when it has none. Under the buttons, **Changed** shows when the rule was last saved and by whom. Changes apply at once.

While you type an address, Blink checks it:

* **The prefix length must be 0 to 32.** (or 128 for IPv6) means the number after the `/` is out of range.
* **This range covers a large part of the internet.** is a warning only: the range is very wide, so it restricts little.

When you select **Add**, **That entry is already in the rule.** means the entry is listed already.

Add your fallback first

Before you narrow the rule to your office, add your company VPN or a second office as well. If one of them is down, the others still let you in.

### Lock-out protection

[Section titled “Lock-out protection”](#lock-out-protection)

Blink won’t save a console rule that would shut you out. If the entries don’t allow the address you are connecting from, the card shows **This rule would lock you out.** with your address, and **Save rule** stays off until you add it, or an entry that covers it.

Blink only sees the address of your current connection. If your rule only has IPv4 entries (or only IPv6 entries), the card warns that your browser may reach the console over the other kind of address, or through a second network such as a VPN, next time. Add that address too.

If your team is shut out anyway, for example because your office’s address changed, see [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/).

### Live connections closed on save

[Section titled “Live connections closed on save”](#live-connections-closed-on-save)

A new rule applies to connections that are already open, not only new ones. After each edit, the card checks what saving would do:

* **No live connection would close.**
* **Saving closes** followed by what would close, for example “2 live viewers and 1 terminal”, **outside the new rule.**

A console rule closes live viewers and terminals opened from addresses outside it. When something would close, saving asks **Close live connections?** and you confirm with **Save and close them**. If the check failed, saving asks **Save without a preview?** instead, because it may close any live connection outside the rule; select **Save anyway** to go ahead.

## Set an organization’s agent rule

[Section titled “Set an organization’s agent rule”](#set-an-organizations-agent-rule)

1. Switch to the organization with the organization switcher. The card does not show while **All organizations** is selected.
2. Open **Organizations**. The **Agent IP rules** card is below the **Current organization** panel.
3. Add, edit and save entries as for the console rule: **IP range** or **Country**, **Note**, **Add**, then **Save rule**.

The agent rule has no lock-out check, because it never affects your own console. Saving it closes that organization’s device connections, Access sessions and Access terminals that come from addresses outside the rule, after the same **Close live connections?** confirmation.

A device outside the rule shows **blocked by IP rule** in the device list. See [Manage Access devices](/use/manage-devices/).

## Test an address

[Section titled “Test an address”](#test-an-address)

Both cards let you check an address against the saved rule, before or after you change it:

1. Under **Test an address against the saved rule**, enter an IP address. Leave it empty to test your own address.
2. Select **Test**.

The result shows **Allowed** or **Refused**, the address and its country, and the reason, for example:

* **Allowed: matches 198.51.100.0/24.**
* **Allowed: the rule is empty, so it restricts nothing.**
* **Refused: neither the address nor its country is in the rule.**
* **Refused: the address is not in the rule, and it has no country to match.**

The test checks the saved rule, not your unsaved edits.

## Remove or delete a rule

[Section titled “Remove or delete a rule”](#remove-or-delete-a-rule)

To lift a restriction, remove every entry. The card then says **No entries: saving removes the restriction.** Select **Save rule**, and Blink shows **Rule removed**. An empty rule closes nothing.

If your [plan](/configure/plans-and-limits/#when-something-is-not-in-your-plan) doesn’t include IP and country rules, the card shows **Not included in your plan: IP and country rules**. Entries that are already saved stay enforced, and you can’t change them, but you can still remove the whole rule with **Delete rule**. Blink asks **Delete the console rule?** or **Delete the agent rule?** first.

## Warnings on the card

[Section titled “Warnings on the card”](#warnings-on-the-card)

* **The stored rule cannot be read.** Blink can’t read the saved rule, so it refuses every address the rule covers until it is replaced. Save a new rule, or an empty one; **Save rule** works here even without an edit. If this keeps happening, contact [IZT](https://izt.app).
* **The country database is not loaded.** **Country** entries match nothing until it is. **IP range** entries still apply. Contact [IZT](https://izt.app) if this stays.

## IP rules, the allowlist and bans

[Section titled “IP rules, the allowlist and bans”](#ip-rules-the-allowlist-and-bans)

The **Security** page also has an **Allowlist** and **Bans**. They do different jobs:

* The **IP and country rules** decide who may use the console, or connect a device, at all.
* The **Allowlist** only exempts trusted networks from rate limits and bans. An allowlisted address outside the console rule is still refused.
* **Bans** refuse addresses that failed too often, or that you banned yourself, for a while.

See [Security settings](/configure/security-settings/).

## What blocked people and devices see

[Section titled “What blocked people and devices see”](#what-blocked-people-and-devices-see)

* On the sign-in page: **Access to the console from this network is not allowed.**
* A signed-in user moved to a network outside the console rule sees **Not available from this network**, with their address and country. They stay signed in, and the page checks again every 30 seconds.
* A viewer shows **blocked by IP rule** and does not reconnect. A terminal disconnects, and keeps running on the device for 2 minutes.
* An Access device outside its organization’s agent rule shows **blocked by IP rule** in the device list.

For each of these, and for getting back in, see [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/).

## Alerts and activity

[Section titled “Alerts and activity”](#alerts-and-activity)

* When an organization’s Access device is refused by its agent rule, instance owners get the alert **Agent blocked by IP rule**, at most once per organization per day. Refusals by the console rule are not alerted. See [Owner alerts and webhooks](/configure/alerts/).
* The activity log records **Changed the console IP rule** and **Changed the agent IP rule**, **Cleared the console IP rule** when the console rule was cleared outside the console to get a team back in, and **Refused by an IP rule** for refused connections. Refusals are grouped by address and hour, with a count, so a busy address doesn’t flood the log.

## Country data

[Section titled “Country data”](#country-data)

Countries come from a country database that ships with your Blink server and is updated with each server release. The line at the bottom of each card shows its date, for example **Country database of November 2026**, and the credit **IP geolocation by DB-IP (<https://db-ip.com>), CC BY 4.0.**

A country match is only as good as the address data. A VPN, a mobile network or a cloud provider may appear in a different country from the one the person is in. When in doubt, use **IP range** entries for your own networks, and test them.

# Check and renew your license

> Read your license status, renew it online or offline, and know what happens if it expires.

Your Blink license is issued by IZT for your Blink server. It sets the hostname agents connect to and your plan: what your server offers, and how many technician seats and Access devices it has. You see it on **Instance** › **License**. You need the **View license** permission to see the page; only instance owners can activate, renew or import a license, and the page says **Only an instance owner can activate, renew or import.** to everyone else.

To activate a new server for the first time, see [Install](/install/).

## Read the license status

[Section titled “Read the license status”](#read-the-license-status)

The pill at the top of the **License** card shows the status:

| Status                | Meaning                                                                                          |
| --------------------- | ------------------------------------------------------------------------------------------------ |
| **Active**            | The license is valid.                                                                            |
| **Expired, in grace** | The license has expired and is in its 30-day grace period. Everything still works. Renew it now. |
| **Lapsed**            | The license and its grace period are over. Renew it.                                             |
| **Not activated**     | The server has never been activated.                                                             |
| **Not valid**         | The stored license does not belong to this server. The page says why.                            |

The card also shows:

* **Customer** and **Hostname**.
* **Plan**: **Blink Core** or **Blink Pro**, with any add-ons after it.
* **Technician seats** and **Access devices**: how many are in use out of how many your plan includes, for example **8 of 10**, or a number with **(unlimited)**. An **over the limit** pill appears when more are in use than the plan allows.
* **Deployment** (cloud licenses renew monthly, on-premises licenses yearly).
* **Expires**: the expiry date and, when the license has expired, **Grace until**.
* **Renews**: for a server that renews online, the date automatic renewal starts and the result of the last attempt.
* **Activation**: **Online** (activated over the internet; Blink View uses 6-digit codes) or **Offline** (activated with a license file; Blink View uses direct links). It only matters if your license includes Blink View: see [Online and offline instances](/use/blink-view/#online-and-offline-instances).
* **Issued** and **License id**.
* **Instance**, the identifier of your server. Select the copy icon next to the instance id when IZT asks for it. This row, and the **Agent builds** card below, need the **Instance settings** permission as well.
* **Agents connect to**: the address agents use to reach this server.

Below the details, a checklist shows every feature by group, ticked when your plan includes it and greyed out when it does not. See [Understand your plan and its limits](/configure/plans-and-limits/) for what each plan includes and how seats and devices are counted.

### Banners

[Section titled “Banners”](#banners)

A banner over every console page warns everyone with the **View license** permission, with an **Open License** link:

* when the license is in grace, lapsed or not valid;
* when more users are active than your plan has seats, for example **12 users for 10 technician seats: new users are refused until you are under the limit.** People who can manage users get an **Open Users** link instead;
* when more Access devices are enrolled than your plan allows, for example **60 Access devices for 50: new enrollments are refused until you are under the limit.**

Over the limit, nobody is locked out and no device is dropped. See [When you change plans](/configure/plans-and-limits/#when-you-change-plans).

## Renew online

[Section titled “Renew online”](#renew-online)

A server that can reach IZT renews its license automatically before it expires, and keeps retrying if an attempt fails. You don’t need to do anything.

To renew straight away, an instance owner selects **Renew now** on the **License** card. The button shows only on a server that renews online. The page confirms with **License renewed**.

**Renew now** is also how you pick up a plan change straight away: after IZT changes your plan, renew to get the new license instead of waiting for the next automatic renewal.

## Renew offline

[Section titled “Renew offline”](#renew-offline)

A server that can’t reach IZT renews the same way it was activated offline, without needing a new activation code:

1. On **Instance** › **License**, under **Activate again**, check the **Hostname**.
2. Under **Offline**, select **Activation request** to download the request file.
3. On `license.blink.izt.app`, use the **Renew** page and upload the request. The portal returns a license file.
4. Back on the **License** page, select **License file** and choose the license file from the portal.

## If your license expires

[Section titled “If your license expires”](#if-your-license-expires)

When a license expires, a **30-day grace period** starts. During it, nothing changes except the warning banner.

After the grace period, the license has lapsed:

* Your server gets no new agent builds or agent updates.
* Agents already installed keep connecting, and Support sessions keep working.
* Everything in your plan keeps working. Only agent builds and updates stop.

Renew the license, online or offline, to return it to **Active**.

Tip

If renewal keeps failing, the **Renews** line shows the last error. Contact [IZT](https://izt.app) with your instance id.

## License events in the activity log

[Section titled “License events in the activity log”](#license-events-in-the-activity-log)

License changes appear on **Instance** › **Activity** as **Activated the license**, **License activation failed**, **Imported a license**, **License import failed**, **Renewed the license** and **Exported an offline license request**.

## Third-party notices

[Section titled “Third-party notices”](#third-party-notices)

The bottom of the **License** page carries the credit **IP geolocation by DB-IP, licensed under CC BY 4.0.**, for the country data used by the [IP and country rules](/configure/ip-and-country-rules/#country-data), and a **Third-party notices** link.

# Manage organizations and teams

> Create an organization for each customer, switch between them, and manage who is on each organization's team.

An organization is a separate space for one customer or team, with its own members, groups, enrollment keys, devices, sessions and recordings. If you are a managed service provider, create one organization per customer. People in one organization can’t see another organization’s devices or sessions unless they are given access to it.

## Switch between organizations

[Section titled “Switch between organizations”](#switch-between-organizations)

The organization switcher at the top of the console shows the organization you are working in. Open it to search for and pick another organization, or choose **All organizations** for an overview across every organization you can reach.

The **Organizations** page, under **Organization** in the sidebar, lists every organization you can reach and how you reach it under **Your access**. Select **Switch** to work in another one.

## Create an organization

[Section titled “Create an organization”](#create-an-organization)

You need the **Create organizations** instance permission.

If your plan does not include **Multiple organizations**, you can have one organization. Once it exists, **Multiple organizations: not in your plan** shows in place of **New organization**. Your first organization never needs it. See [Understand your plan and its limits](/configure/plans-and-limits/).

1. Open **Organizations** and select **New organization**. You can also do this from **Instance** › **Organizations**.
2. Enter a **Name**, for example the customer’s company name.
3. Select **Create**.

You become the organization’s first **Owner**. Everything else (team, groups, enrollment keys and devices) starts empty. Next, add the team and [enroll devices](/install/).

**Instance** › **Organizations** lists every organization on your server, whether or not you are a member, with its status and its numbers of members and devices.

## Rename an organization

[Section titled “Rename an organization”](#rename-an-organization)

You need the **Edit organization** permission.

1. Switch to the organization and open **Organizations**.
2. In the **Current organization** panel, select **Rename**.
3. Enter the new **Name** and select **Rename**.

The organization’s slug (its short identifier) stays the same.

## Delete an organization

[Section titled “Delete an organization”](#delete-an-organization)

You need the **Delete organization** permission in that organization, or the **Delete any organization** instance permission.

1. Switch to the organization and open **Organizations**, then select **Delete** in the **Current organization** panel. Instance administrators can also use the bin icon on **Instance** › **Organizations**.
2. Type the organization’s name to confirm.
3. Select **Delete organization**.

Danger

After deletion, nobody can reach the organization’s devices, sessions or recordings, and its enrollment keys stop working. Agents already installed on its devices stay installed.

## Limit where devices connect from

[Section titled “Limit where devices connect from”](#limit-where-devices-connect-from)

Each organization can have an agent IP rule: a list of IP ranges and countries its Access devices may connect from. It covers their connection to the server, Access sessions, terminals and enrollment. Support sessions are never restricted.

1. Switch to the organization (not **All organizations**) and open **Organizations**.
2. Use the **Agent IP rules** card below the **Current organization** panel.

You need **View agent IP rules** to see the card and **Manage agent IP rules** to change it. A device outside the rule shows **blocked by IP rule** in the device list. See [Restrict access by IP address and country](/configure/ip-and-country-rules/#set-an-organizations-agent-rule).

## Manage the team

[Section titled “Manage the team”](#manage-the-team)

The **Team** page shows who belongs to the current organization and what role they have there. A member’s role applies to the whole organization.

### Add a member

[Section titled “Add a member”](#add-a-member)

The person must already have a Blink user account. Blink does not send email invitations: an instance administrator first creates the account on the **Users** page (see [Add and manage users](/configure/users/)). Someone with the **Manage users** instance permission can add any user. Other team managers can only add people who are already in an organization they can access.

1. Open **Team** and select **Add member**.
2. Enter the person’s **Email**.
3. Choose a **Role**. Roles are grouped as **Built-in**, **Instance** and **Organization**. Choose **Member (group access only)** if the person should only reach the devices in certain groups.
4. Select **Add member**.

You need the **Add members** permission. Giving someone the **Owner** role also needs **Manage owners**.

### Change a member’s role

[Section titled “Change a member’s role”](#change-a-members-role)

On the **Team** page, pick a new role in the member’s **Role** list. You need the **Change member roles** permission, and **Manage owners** to give or take the **Owner** role.

Note

An organization always keeps at least one active **Owner**. Blink refuses to change the role of, suspend or remove the last one.

### Suspend or reactivate a member

[Section titled “Suspend or reactivate a member”](#suspend-or-reactivate-a-member)

Suspending keeps the membership but blocks the person’s access to this organization. You need the **Change member roles** permission.

* To suspend, select the pause icon on the member’s row.
* To reactivate, select the play icon.

You can’t suspend yourself.

### Remove a member

[Section titled “Remove a member”](#remove-a-member)

Select the bin icon on the member’s row and confirm with **Remove**. The person loses access to this organization and all their group roles here. Their user account stays. You need the **Remove members** permission.

### Access from the instance

[Section titled “Access from the instance”](#access-from-the-instance)

The **Access from the instance** card on the **Team** page lists people who reach this organization without being members:

* **Instance owners**, who have every permission in every organization except the terminal and Backstage as SYSTEM permissions, which only a role can give.
* People with an instance role given for **All organizations** or **Selected organizations** on the **Users** page.

You change this access on the **Users** page. See [Add and manage users](/configure/users/#give-a-user-a-role).

## Related

[Section titled “Related”](#related)

* [Roles and permissions](/configure/roles/)
* [Limit access with groups](/configure/groups/)
* [Restrict access by IP address and country](/configure/ip-and-country-rules/)
* [Choose the name customers see](/configure/technician-name/), which each organization can set for itself

# Understand your plan and its limits

> What Blink Core and Blink Pro include, how technician seats and Access devices are counted, and what changes when your plan does.

Your Blink license carries your plan: which Blink features your server offers, how many technician seats it has, and how many Access devices can enroll. IZT sets the plan when it issues the license. You see it on **Instance** › **License**, next to the license status. See [Check and renew your license](/configure/license/) for the rest of that page.

## Blink Core and Blink Pro

[Section titled “Blink Core and Blink Pro”](#blink-core-and-blink-pro)

The **Plan** row on the **License** card names your plan: **Blink Core** or **Blink Pro**. If your license includes add-ons, they follow the plan name, joined with a plus sign.

Blink Pro is Blink Core plus three features that keep a record of each session:

| Feature                                                                    | Blink Core | Blink Pro |
| -------------------------------------------------------------------------- | ---------- | --------- |
| **Session recording**: record new sessions (video and audio)               |            | ✓         |
| **Terminal history**: keep transcripts of new terminals                    |            | ✓         |
| **Session timeline**: a detailed timeline and session log for new sessions |            | ✓         |
| Everything else listed below                                               | ✓          | ✓         |

Below the card details, the **License** page lists every feature by group, ticked when your plan includes it and greyed out with a dash when it does not:

* **Session modes**: **Unattended Access**, **Attended Support**.
* **Session capabilities**: **Remote control**, **File transfer**, **Clipboard sync**, **Remote terminal**, **Backstage**, **Power actions**, **Elevation**, **Install Access from Support**, **Remote audio**, **Chat**, **Secret messages**.
* **History**: **Session history**, **Session timeline**, **Session recording**, **Terminal history**.
* **Administration**: **Multiple organizations**, **Custom roles**, **Audit log**, **Tech name**, **IP and country rules**.

The **Limits**, **Technician seats** and **Access devices**, appear as rows on the card itself.

**Chat** and **Secret messages** are part of both Blink Core and Blink Pro. Secret messages need **Chat** as well. If your **License** page does not tick them, contact IZT. See [Chat with the customer](/use/chat/).

A license can also leave out one of the session modes, for example a plan with **Attended Support** only and no **Unattended Access**. The checklist always shows what your own license includes.

## Technician seats

[Section titled “Technician seats”](#technician-seats)

Every user account takes a technician seat: administrators and pending invites included. Disabled users do not take a seat.

* At the limit, creating a user is refused, and so is enabling a disabled user: the user stays disabled.
* If you can see the license, the **Users** page header shows how many seats are in use, for example **8 of 10 seats**. When every seat is taken, **New user** is greyed out.
* To free a seat, disable or delete a user you no longer need. See [Add and manage users](/configure/users/).

The **Technician seats** row on the **License** card shows the same count, for example **8 of 10**, or a number with **(unlimited)** when your plan has no limit.

## Access devices

[Section titled “Access devices”](#access-devices)

Every enrolled Access device counts against the **Access devices** limit, unless it is revoked or uninstalled.

At the limit, Blink refuses:

* a new enrollment,
* an uninstalled device enrolling again,
* **Un-revoke** on a revoked device.

Devices already enrolled keep working: Blink never drops a device because of the limit. Enrollment keys are not devices, so you can still create keys at the limit.

When an enrollment is refused at the limit, instance owners get an alert, **Device limit reached**, at most once an hour. On the computer, the Access agent install stops with exit code 20 and the message **This Blink plan’s device limit is reached. Ask your administrator.** See [Install the Access agent on Windows](/install/access-agent-windows/).

To free a device, revoke or delete one you no longer need. See [Manage Access devices](/use/manage-devices/).

## When something is not in your plan

[Section titled “When something is not in your plan”](#when-something-is-not-in-your-plan)

Blink hides or marks what your plan does not include:

* **Whole sections disappear** when there is nothing left to do in them. **Enrollment** is gone from the sidebar without **Unattended Access**, and **Activity** without **Audit log**.
* **A callout** names the missing feature on the page it affects, for example **Not included in your plan: Session recording**, with a line on what that means.
* **A pill** replaces a button, for example **Custom roles: not in your plan** in place of **New role**.

If an action reaches the server anyway, the console shows the server’s answer:

| Message                                                                                                                                                         | Meaning                             |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
| **Your plan does not include** *feature*. *What it does.* For example: **Your plan does not include Session recording. Record new sessions (video and audio).** | The feature is not in your plan.    |
| **Your plan includes** *N* **technician seats and** *M* **are in use. Technician seats: ask your provider to raise the limit.**                                 | Every technician seat is taken.     |
| **Your plan includes** *N* **Access devices and** *M* **are in use. Access devices: ask your provider to raise the limit.**                                     | The Access device limit is reached. |

A permission that needs a feature your plan lacks does nothing while the plan lacks it. The person keeps the permission, and it works again once the feature is back in the plan. See [Roles and permissions](/configure/roles/).

Without a valid license, either before activation or when the license shows **Not valid**, nothing in the plan is available: the console marks everything as not in your plan, and Support codes, enrollment and new users are refused. See [Activate your license](/get-started/activate-your-license/).

## When you change plans

[Section titled “When you change plans”](#when-you-change-plans)

To change plans, or to add technician seats or Access devices, contact IZT. The new plan arrives with your next license: through automatic renewal, when an instance owner selects **Renew now**, or through the offline renewal exchange. See [Check and renew your license](/configure/license/).

When the plan changes:

* **Sessions in progress** keep what they started with until they end. New sessions, and new viewer connections, follow the new plan.
* **Each session keeps the record it started with.** A session started without recording or a timeline stays without one after an upgrade, and a session started with them keeps them after a downgrade.
* **Existing recordings, terminal transcripts and timelines stay.** You can still play, download and delete them after a downgrade.
* **Over the limit after a downgrade**, nobody is locked out and no device is dropped. A banner tells everyone who can see the license, for example **12 users for 10 technician seats: new users are refused until you are under the limit.** or **60 Access devices for 50: new enrollments are refused until you are under the limit.** New users or enrollments are refused until you are back under the limit.

## Who can see the plan

[Section titled “Who can see the plan”](#who-can-see-the-plan)

The **License** page, and with it the plan, seat and device counts, needs the **View license** permission. Instance owners have it. Anyone else gets it from an instance role given for all organizations on the **Users** page; none of the starter roles includes it. See [Instance roles and organization roles](/configure/roles/#instance-roles-and-organization-roles).

When Blink was upgraded to a version with plans, every role that had the **Instance settings** permission was given **View license** as well.

# Recording storage and log levels

> Control how long recordings and session logs are kept, who can see or delete them, and how to turn up an agent's logging.

When your plan includes them, Blink records every screen a technician watches (**Session recording**), keeps a transcript of every remote terminal (**Terminal history**) and keeps a timeline and log of every session (**Session timeline**). These are part of Blink Pro. See [Blink Core and Blink Pro](/configure/plans-and-limits/#blink-core-and-blink-pro). This page covers how long they are kept and who can reach them. To find and play recordings, see [Use Blink](/use/).

If your plan changes, recordings, transcripts and session logs you already have stay available: people with the permissions below can still play, download and delete them, and the retention settings on this page still apply to them. A session started without recording or a timeline stays without one.

## Who can see recordings and logs

[Section titled “Who can see recordings and logs”](#who-can-see-recordings-and-logs)

Access to recordings and logs comes from roles. The permissions are:

* **View recordings**, **Download recordings** and **Delete recordings**, each for **Own** sessions (the ones the person started) or **Any** session they can reach.
* **View logs**, for session and device logs and the timeline.
* **Change log levels**, to change an agent’s live log levels.

Deleting recordings removes a session’s video and audio; the session and its log stay. To delete a whole ended Support session with its recording and log, a person needs **Delete support sessions**.

See [Roles and permissions](/configure/roles/) to build a role with exactly these.

## How long recordings are kept

[Section titled “How long recordings are kept”](#how-long-recordings-are-kept)

### On Blink Cloud

[Section titled “On Blink Cloud”](#on-blink-cloud)

Recording storage limits are part of your Blink Cloud service. Contact [IZT](https://izt.app) to change them.

### On your own server

[Section titled “On your own server”](#on-your-own-server)

By default, a self-hosted Blink server keeps recordings forever. You can limit them with two server start-up options:

| Option                      | What it does                                                                                                                                                       |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-recording-retention-days` | Finished recordings older than this many days are deleted. The check runs daily. `0` (the default) keeps them forever.                                             |
| `-recording-quota-mb`       | The most storage, in MiB, that recordings and terminal transcripts may use. Over it, the oldest finished recordings are deleted. `0` (the default) means no limit. |

Add the options to the command that starts your Blink server and restart it. See [Install](/install/) for how your server is started.

Plan for about 1 GB of storage per hour of recording, per monitor watched. To work out how much disk space you need, see [Plan storage for recordings](/install/on-premises-server/#plan-storage-for-recordings).

Caution

Deleted recordings can’t be recovered. If you need recordings for compliance, download them before they reach the retention limit.

## How long session logs are kept

[Section titled “How long session logs are kept”](#how-long-session-logs-are-kept)

Session and device logs are kept for:

* **30 days** for records at Info level and above.
* **3 days** for Debug and Trace records.

On your own server, you can change these with the `-log-retention` and `-log-debug-retention` start-up options, as a duration such as `720h`. `0` keeps records forever. A change applies to new records only.

Records written while [diagnostic mode](/troubleshooting/diagnostic-mode/) is on are kept as long as Info records, whatever their level.

## Change an agent’s log levels

[Section titled “Change an agent’s log levels”](#change-an-agents-log-levels)

When IZT support or your own team needs more detail to diagnose a problem, you can turn up the logging of one agent without touching the customer’s computer. To turn it up for every session and device at once, use [diagnostic mode](/troubleshooting/diagnostic-mode/). You need the **Change log levels** permission.

You can do this for:

* **An Access device**: on the device’s details, select **Log levels**.
* **A live session**: on the session’s log page, select **Log levels**. You can’t change levels after the session has ended.

In the **Log levels** dialog:

1. Choose a preset: **Normal**, **Debug all**, **Media**, **Input**, **Backstage** or **Install**. Or set the **Default level** and the level of individual components yourself.
2. For a device, choose **Revert after**: **1 hour**, **24 hours** (the default), **7 days** or **Never**.
3. Select **Apply**.

The dialog shows the **Current** levels, and for a device, when they revert. Choose **Normal** to go back to the usual level.

Tip

Records below a component’s level are not stored, but the agent still keeps recent detailed records in memory and sends them along when an error occurs. You often get enough detail without turning levels up.

Caution

**Debug all** can produce a large volume of records. Remember that Debug records are only kept for 3 days.

# Roles and permissions

> Understand the Owner role and the starter roles, and create custom roles with exactly the permissions your team needs.

A role is a named set of permissions. You give people roles on the **Team** page (for a whole organization), on the **Groups** page (for one group of devices), or on the **Users** page (for all or selected organizations). Blink checks every action against the permissions of the roles a person holds, and their permissions add up.

## The roles Blink starts with

[Section titled “The roles Blink starts with”](#the-roles-blink-starts-with)

### Owner

[Section titled “Owner”](#owner)

**Owner** is the only built-in role. It has every permission in its organization, including permissions added in later versions of Blink. It can’t be changed or deleted, and it can only be given for a whole organization, never on a group. Whoever creates an organization becomes its first Owner.

### Starter roles: Admin, Technician and Viewer

[Section titled “Starter roles: Admin, Technician and Viewer”](#starter-roles-admin-technician-and-viewer)

A new Blink server comes with three starter roles. They are ordinary instance roles: you can edit them, copy them or delete them.

| Role           | Description in the console                                                                                        | What it includes                                                                                                                                                                                                                                                                                                                                     |
| -------------- | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Admin**      | Everything except renaming or deleting the organization, managing owners, terminal access and backstage as SYSTEM | All Support, Access, Recordings, Logs, Enrollment, Groups and Members permissions (except the terminal and Backstage as SYSTEM), plus **Manage org roles**, **View activity**, **View agent IP rules** and **Manage agent IP rules**                                                                                                                 |
| **Technician** | Support and Access sessions, device control and recordings                                                        | Create and join Support sessions with control, clipboard, file transfer, Run as admin and Install Access; view and connect to devices with Backstage, control, clipboard, file transfer, Reboot and Edit devices; Blink View and chat in Support and Access sessions; end any session; view and download recordings; view logs and change log levels |
| **Viewer**     | Watch sessions, see devices, play recordings and read logs                                                        | Join any Support or Access session (view only), view devices, view and download recordings, view logs                                                                                                                                                                                                                                                |

### Member (group access only)

[Section titled “Member (group access only)”](#member-group-access-only)

**Member (group access only)** is not a role with permissions. It makes someone a member of the organization with no organization-wide permissions, so they reach only the groups where you give them a role. See [Limit access with groups](/configure/groups/).

### Instance owners

[Section titled “Instance owners”](#instance-owners)

Instance owner is not a role either. It is a setting on a user that gives them every instance permission and every organization permission except the three [granted on their own](#permissions-granted-on-their-own). See [Instance owners](/configure/users/#instance-owners).

## Instance roles and organization roles

[Section titled “Instance roles and organization roles”](#instance-roles-and-organization-roles)

Every custom role has a scope, which you choose when you create it:

* **All organizations**: an instance role, defined once and usable in every organization and on the **Users** page. Only people with the **Manage instance roles** permission can create or change instance roles.
* **This organization**: an organization role, usable only in the organization where it was made. People with the **Manage org roles** permission can create them.

The scope can’t be changed later

A role’s scope is fixed when you create it. To have a version of a role in the other scope, copy it.

The **Roles** page lists every role you can use in the current organization. The **Kind** column shows **Built-in**, **Instance** or **Organization**, and **In use** shows how many people hold it. Instance administrators also find the instance roles under **Instance** › **Roles**.

## Create a role

[Section titled “Create a role”](#create-a-role)

1. Open **Roles** (or **Instance** › **Roles**) and select **New role**.

2. If you can create both kinds, choose the **Scope**: **This organization** or **All organizations**.

3. Enter a **Name** (up to 64 characters) and, optionally, a **Description**. The name **Owner** is reserved.

4. Choose the permissions:

   * **All permissions** includes everything, including permissions added later. For an instance role it excludes instance administration.
   * **All *area* permissions** includes a whole area, including permissions added to it later.
   * Otherwise, tick permissions one at a time.

5. Select **Save role**.

If your plan does not include **Custom roles**, the **Roles** page shows **Custom roles: not in your plan** in place of **New role**, and roles can’t be copied. Only the starter roles **Admin**, **Technician** and **Viewer** stay editable. Every other role is marked **read-only**: it keeps working and can still be given to people, but it can’t be changed, and the editor says **Not included in your plan: Custom roles. This role keeps working but cannot be changed.** You can still delete such a role. See [Understand your plan and its limits](/configure/plans-and-limits/).

You can only give what you have

You can’t put a permission into a role unless you hold it yourself. Permissions you don’t hold are greyed out with **You don’t have this permission**. This stops anyone from creating a role more powerful than their own.

### Own or Any sessions

[Section titled “Own or Any sessions”](#own-or-any-sessions)

Some session permissions offer **None**, **Own** or **Any**:

* **Own**: only sessions the person started.
* **Any**: every session they can reach.

These are **Join support sessions**, **End support sessions**, **Delete support sessions**, **Join access sessions**, **End access sessions**, **View recordings**, **Download recordings** and **Delete recordings**. Anyone who can create a session can always join their own.

### Permissions granted on their own

[Section titled “Permissions granted on their own”](#permissions-granted-on-their-own)

Three permissions are never included by ticking a whole area. A role gets them only by naming them, or through **All permissions**:

* **Terminal (support)**
* **Terminal (access)**
* **Backstage as SYSTEM**

The console marks them with **Not included in ‘all’ for this area. Grant it on its own.** Terminals are recorded when your plan includes **Terminal history**, and Backstage sessions when it includes **Session recording**.

### Organization-level permissions on a group

[Section titled “Organization-level permissions on a group”](#organization-level-permissions-on-a-group)

The Enrollment, Groups, Members, Roles, Organization and Activity areas apply organization-wide only. When a role is given on a group, those permissions are ignored, and the editor says so with **Ignored when this role is given on a group.**

Instance permissions only apply when a role is given for all organizations on the **Users** page.

### Permissions your plan does not include

[Section titled “Permissions your plan does not include”](#permissions-your-plan-does-not-include)

Some permissions only do something when your plan includes the matching feature, for example **Terminal (support)** needs **Attended Support** and **Remote terminal**, and **Connect to devices** needs **Unattended Access**. The role editor still lists them, so a role always shows what it grants, but marks each one your plan does not cover with **Not included in your plan:** and the missing features. Blink ignores those permissions while your plan lacks the feature. Roles that hold them can still be given to people, and the permissions take effect if your plan later includes the feature. See [Understand your plan and its limits](/configure/plans-and-limits/#when-something-is-not-in-your-plan).

## Edit, copy or delete a role

[Section titled “Edit, copy or delete a role”](#edit-copy-or-delete-a-role)

On the **Roles** page, select a role to view it, or use the icons at the end of its row:

* **Edit** (pencil): change the name, description or permissions. Roles you can’t change open read-only, with an eye icon.
* **Copy**: start a new role from this one’s permissions. If the copy includes permissions you don’t hold or that its scope doesn’t allow, the editor leaves them out and tells you which.
* **Delete** (bin): only works when nobody holds the role. Change those people’s roles first.

## Turn organization roles on or off

[Section titled “Turn organization roles on or off”](#turn-organization-roles-on-or-off)

People with the **Instance settings** permission decide whether organizations may have their own roles. This is useful when, for example, a customer’s own staff manage their organization.

1. Open **Instance** › **Settings**.
2. Under **Organization roles**, tick or clear **Allow organization roles**.

When it is off, existing organization roles keep working but can’t be changed or given to anyone new. They can still be deleted. The **Roles** page then shows a notice, and those roles are marked **read-only**.

## Permission reference

[Section titled “Permission reference”](#permission-reference)

These are the permissions you can put in a role, by area, as the role editor lists them.

### Support

[Section titled “Support”](#support)

| Permission                           | Allows                                                                                                                                                                                           |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Create support sessions              | Create a Support code or link, organization-wide or in a group where the permission is held                                                                                                      |
| Join support sessions (own or any)   | Open the viewer on a Support session (view only) and see it in lists                                                                                                                             |
| Control (support)                    | Keyboard, mouse, type-text and held keys                                                                                                                                                         |
| Clipboard (support)                  | Clipboard sync, both directions                                                                                                                                                                  |
| File transfer (support)              | File transfer, both directions                                                                                                                                                                   |
| Run as admin (support)               | Send administrator credentials and consent to elevation prompts                                                                                                                                  |
| Install Access                       | Turn a Support session into an enrolled Access device                                                                                                                                            |
| Terminal (support)                   | Open a command window on the customer’s computer as the customer, or as administrator when the session is elevated (also needs Run as admin). Recorded when your plan includes terminal history. |
| Blink View (support)                 | Create Blink View codes and accept a customer’s phone camera into the session (also send the QR code to the customer’s computer and end the camera)                                              |
| Chat (support)                       | Chat with the customer in Support sessions; secret messages when the plan includes them                                                                                                          |
| End support sessions (own or any)    | End a Support session                                                                                                                                                                            |
| Delete support sessions (own or any) | Delete an ended Support session with its recording and log                                                                                                                                       |

### Access

[Section titled “Access”](#access)

| Permission                        | Allows                                                                                                                                                                                             |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| View devices                      | See devices, presence and device details                                                                                                                                                           |
| Connect to devices                | Start an unattended session on a device                                                                                                                                                            |
| Join access sessions (own or any) | Open the viewer on an existing Access session (view only) and see it in lists                                                                                                                      |
| Backstage                         | Start and join backstage (hidden desktop) sessions; apps there run as the signed-in user                                                                                                           |
| Backstage as SYSTEM               | Backstage apps run as SYSTEM instead of the signed-in user. A backstage session started with it can only be joined by people who also hold it. Recorded when your plan includes session recording. |
| Control (access)                  | Keyboard, mouse and type-text; also run as admin in Access sessions                                                                                                                                |
| Clipboard (access)                | Clipboard sync                                                                                                                                                                                     |
| File transfer (access)            | File transfer                                                                                                                                                                                      |
| Reboot                            | Reboot the device normally                                                                                                                                                                         |
| Safe Mode reboot                  | Reboot the device into Safe Mode with Networking (also allows a normal reboot)                                                                                                                     |
| Terminal (access)                 | Open a command window on a device as SYSTEM or as a signed-in user. Recorded when your plan includes terminal history.                                                                             |
| Blink View (access)               | Create Blink View codes and accept a customer’s phone camera into the session (also end the camera)                                                                                                |
| Chat (access)                     | Chat with the signed-in user of a device, before and during a session; secret messages when the plan includes them                                                                                 |
| End access sessions (own or any)  | End an Access session                                                                                                                                                                              |
| Edit devices                      | Rename, edit tags, change groups, push an agent update                                                                                                                                             |
| Remove devices                    | Revoke, un-revoke or unenroll a device                                                                                                                                                             |

Watching a live [Blink View](/use/blink-view/) camera needs only permission to join the session, and the end permissions can end the camera too. Roles with **All Support permissions**, **All Access permissions** or **All permissions** get **Blink View (support)** and **Blink View (access)** automatically. Custom roles that list permissions one by one do not get them until you add them.

The same goes for [chat](/use/chat/): **Chat (support)** and **Chat (access)** come with the **Owner**, **Admin** and **Technician** roles and with **All Support permissions**, **All Access permissions** or **All permissions**, but not with **Viewer**, and custom roles that list permissions one by one need them added. Chat also needs **Chat** in your plan, and secret messages **Secret messages**.

### Recordings and logs

[Section titled “Recordings and logs”](#recordings-and-logs)

| Permission                       | Allows                                                            |
| -------------------------------- | ----------------------------------------------------------------- |
| View recordings (own or any)     | List and play recordings                                          |
| Download recordings (own or any) | Download whole recording files                                    |
| Delete recordings (own or any)   | Delete a session’s video and audio (the session and its log stay) |
| View logs                        | Session and device logs and the timeline                          |
| Change log levels                | Change the agent’s live log levels                                |

### Organization administration

[Section titled “Organization administration”](#organization-administration)

These apply organization-wide only.

| Permission             | Allows                                                                               |
| ---------------------- | ------------------------------------------------------------------------------------ |
| Enroll devices         | Create and list enrollment keys, build installers                                    |
| Revoke enrollment keys | Revoke enrollment keys                                                               |
| Create groups          | Create device groups                                                                 |
| Edit groups            | Rename device groups                                                                 |
| Delete groups          | Delete device groups                                                                 |
| Manage group access    | List, add and remove group roles                                                     |
| Add members            | Add users to the organization                                                        |
| Remove members         | Remove users from the organization                                                   |
| Change member roles    | Change a member’s role or suspend them                                               |
| Manage org roles       | Create, edit and delete organization roles                                           |
| Edit organization      | Rename the organization and change its settings                                      |
| Delete organization    | Delete the organization                                                              |
| Manage owners          | Give or take the Owner role                                                          |
| View agent IP rules    | See where the organization’s Access agents may connect from                          |
| Manage agent IP rules  | Change the IP ranges and countries the organization’s Access agents may connect from |
| View activity          | The organization’s activity log                                                      |

### Instance administration

[Section titled “Instance administration”](#instance-administration)

These only go in instance roles and only apply when the role is given for all organizations.

No starter role includes **View license**, **Diagnostic mode** or **Send diagnostics to IZT**. Instance owners have them; anyone else needs an instance role that includes them, given for all organizations. If you upgraded from a version without it, every role that already had **Instance settings** was given **View license** too.

| Permission               | Allows                                                                                                                                                                                 |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Create organizations     | Create organizations                                                                                                                                                                   |
| Delete any organization  | Delete any organization                                                                                                                                                                |
| Manage users             | Create and disable users; manage instance role assignments                                                                                                                             |
| Manage instance roles    | Create, edit and delete instance roles                                                                                                                                                 |
| Instance settings        | Instance-wide settings such as organization roles and the name shown to customers, the **Identity** tab, and the **Agent builds** card and instance id on the **License** tab          |
| Instance activity        | The instance-wide activity log                                                                                                                                                         |
| View license             | The license, what the plan includes, and the seats and devices in use                                                                                                                  |
| Certificates             | Upload HTTPS certificates and configure Let’s Encrypt for the console’s host names                                                                                                     |
| View security settings   | See the join-code format, rate limits, bans and the allowlist                                                                                                                          |
| Manage security settings | Change the join-code format and rate limits, ban and unban addresses, edit the allowlist (includes View security settings)                                                             |
| Diagnostic mode          | Turn on, extend and turn off [diagnostic mode](/troubleshooting/diagnostic-mode/) for the whole instance                                                                               |
| Send diagnostics to IZT  | Send every organization’s logs and settings to IZT Support, see and delete what was sent, download a bundle. See [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/) |

**View security settings** and **Manage security settings** also cover seeing and changing the console’s [IP and country rules](/configure/ip-and-country-rules/).

# Security settings

> Set the join-code format, sign-in lifetime, IP and country rules, high-risk confirmations, fleet limits, the chat secret lifetime, rate limits, bans, trusted networks and the Support session timeout.

Instance-wide security settings live on **Instance** › **Security**. They apply to every organization on your server.

* To see the page, you need the **View security settings** permission.
* To change anything on it, you need **Manage security settings**. Without it, the page is read-only and says so at the top.

Each settings card has its own **Save** button, and a **Discard** button appears while it has unsaved changes. Saving changes on this page is a high-risk action, so Blink may ask you to confirm with a passkey or code.

## Join codes

[Section titled “Join codes”](#join-codes)

A join code is what a customer types to join a Support session. Under **Join codes**, choose:

* **Format**: **Digits** (easiest to read out over the phone) or **Letters and digits**. Codes with letters leave out I, L, O and U, so nothing reads as 1 or 0, and case does not matter.
* **Length**: 6 to 12 characters for digits, 5 to 10 for letters and digits. The default is 9 digits.

The **Preview** shows an example code and how many different codes the format allows. Longer codes are harder to guess. Select **Save format**.

Codes already given out keep working until they expire.

## Sign-in lifetime

[Section titled “Sign-in lifetime”](#sign-in-lifetime)

**Sign-in lifetime (days)** sets how long one console sign-in lasts. After it, the browser has to sign in again with password and second factor, however active it was. Choose 1 to 365 days; the default is 30.

A shorter value also applies to sign-ins that are already running.

## IP and country rules

[Section titled “IP and country rules”](#ip-and-country-rules)

The **IP and country rules** card decides where the console can be used from: sign-in, the API and live viewing. When it has entries, every user, the Owner included, needs an address or country listed there, and changes apply at once. Blink won’t save a rule that would lock you out from the address you are connecting from.

See [Restrict access by IP address and country](/configure/ip-and-country-rules/).

## Confirming high-risk actions

[Section titled “Confirming high-risk actions”](#confirming-high-risk-actions)

Some actions need a fresh passkey or code from the person signed in, so a stolen sign-in alone can’t do them: opening a terminal, Backstage tools as SYSTEM, a Safe Mode reboot, Install Access, changes to roles, members, users and two-factor, changes on the Security page, changes to an organization’s agent IP rule, revoking or deleting a device, and changes to the instance identity and keys.

Under **A confirmation lasts**, choose one:

* **Once per sign-in**: the sign-in itself counts. People are asked again only after signing in with a recovery code.
* **For a number of minutes**: 1 to 1440 minutes. People are asked again once their last confirmation is older. This is the default, set to 15 minutes.
* **For a number of actions**: 1 to 100. People are asked again after that many high-risk actions. Set it to 1 to ask every time.

The line under the choices sums up the setting in one sentence.

Note

Loosening this setting raises an owner alert. See [Owner alerts and webhooks](/configure/alerts/).

## Fleet limits

[Section titled “Fleet limits”](#fleet-limits)

Fleet limits cap how many of these one person may start in any hour, across every organization and device:

* **Access sessions per hour** (default 60)
* **Reboots per hour** (default 20)
* **Chats started per hour** (default 60): chats with a device’s signed-in user before a session. See [Chat before you connect](/use/chat/#chat-before-you-connect).

Past a limit, the next one is refused and the instance owners get an alert. Enter `0` for no limit. Loosening a limit also raises an owner alert.

## Chat

[Section titled “Chat”](#chat)

The **Chat** card sets how long a [secret message](/use/chat/#secret-messages) waits to be opened. It appears when your plan includes **Secret messages**.

Under **Secret messages expire after**, choose **5 minutes**, **15 minutes** (the default) or **60 minutes**. Technicians can pick another lifetime for each secret they send; secrets from the customer always get this one. The change applies to secrets sent after you save.

A secret message can be viewed once and is never stored.

## Rate limits

[Section titled “Rate limits”](#rate-limits)

Rate limits protect the public parts of Blink from guessing and abuse. The **Rate limits** table has one row for each of:

| Route                 | Counts                        |
| --------------------- | ----------------------------- |
| **Join codes**        | failed codes                  |
| **Sign-in**           | attempts; wrong passwords ban |
| **Two-factor**        | attempts; wrong codes ban     |
| **Device enrollment** | attempts; unknown keys ban    |

For each route you can set:

* **Per address**: the budget for one address (an IPv4 address, or an IPv6 /64).
* **Per network**: the budget for one network (a /24 or a /48). It must be at least the per-address budget.
* **Global alert**: a server-wide count of failures that only raises an alert in the activity log. It blocks nobody. It must be at least the per-network budget.
* **Window (s)**: the time window the budgets count in, 10 seconds to 1 day.
* **Lockout (s)**: how long a ban lasts, 10 seconds to 30 days.
* **Per account** (Sign-in and Two-factor only): a count and its own window in seconds. Wrong passwords per email and address lock that email from that address. Wrong two-factor codes per user lock the account until the window ends, from every address except allowlisted ones.

How they behave:

* Failures that use up a budget ban the address or network for the lockout.
* Sign-in, two-factor and enrollment also turn away attempts past the budget until the window ends, without a ban, because successful attempts count there too.
* Sign-in and two-factor failures are kept across server restarts.

Enrolling many devices from one site

Enrollment counts every attempt from an address. If you enroll many devices from one network at once, add that network to the [allowlist](#allowlist) first.

### Agent connections

[Section titled “Agent connections”](#agent-connections)

The **Agent connections** table limits connections from **Support agents**, **Access devices** and **Terminals** that have not yet proved who they are: how many may be open per address and on the server, how many failures per minute are allowed, and how long a failing address is blocked. When your server restarts, every agent reconnects at once, so keep these caps generous.

Select **Save limits** to save both tables, or **Restore defaults** to go back to the built-in values. If a field is out of range, it is highlighted; hover over it to see the allowed range.

## Bans

[Section titled “Bans”](#bans)

The **Bans** card lists the addresses and networks refused right now, with the reason, the **Source** (the route whose limit banned it, or **Manual**), when the ban expires, and how many requests it has refused.

* A ban from a rate limit refuses only that route.
* A manual ban refuses every route.

To ban an address or network yourself:

1. Under **Bans**, enter the **Address or network**, for example `203.0.113.7` or `203.0.113.0/24`.
2. Optionally enter a **Reason**.
3. Under **For**, choose **1 hour**, **1 day**, **7 days**, **30 days** or **Until removed**.
4. Select **Ban**.

To end a ban early, select **Lift** on its row. Select the refresh icon to update the list.

Caution

Be careful not to ban your own office network. If your team is locked out by a rate limit, an instance administrator signed in from elsewhere can lift the ban.

## Allowlist

[Section titled “Allowlist”](#allowlist)

The allowlist holds trusted networks, such as your office. Addresses on it are never banned and are not counted per address or per network. The global alert and the server-wide caps still count them.

The allowlist only exempts addresses from rate limits and bans. Who may use the console at all is decided by the [IP and country rules](#ip-and-country-rules).

1. Under **Allowlist**, enter the **Address or network**, for example `198.51.100.0/24`.
2. Optionally add a **Note**, such as the office name.
3. Select **Add**.

To take a network off the list, select **Remove** on its row. The list holds up to 200 entries.

## Support session timeout

[Section titled “Support session timeout”](#support-session-timeout)

A Support session stays open after the technician closes the viewer, so they can come back to it. Under **Support sessions**, set **End after no viewer for (minutes)** to end a session automatically when nobody has watched it for that long. The customer sees the session end.

Enter `0` (never) to keep sessions open until someone ends them. The maximum is one week (10080 minutes).

## Network settings

[Section titled “Network settings”](#network-settings)

The last cards on the page, **Media connections** and **TURN relay**, control how screen, audio and input traffic reaches your server when a direct connection is blocked. On Blink Cloud, these are managed for you and show **Managed by Blink Cloud**. If you run Blink on your own server, see [Install](/install/) for the network setup.

# Sign-in and two-factor authentication

> How console sign-in works, how to set up an authenticator app or a passkey, and what to do about recovery codes and lost devices.

Every sign-in to the Blink console needs a password and a second factor: a passkey, or a 6-digit code from an authenticator app. Two-factor authentication is always on and can’t be turned off. Anyone who hasn’t set it up yet is asked to at their next sign-in.

You manage your own sign-in on the **Account** page, under **You** in the console sidebar.

## Set up two-factor authentication

[Section titled “Set up two-factor authentication”](#set-up-two-factor-authentication)

You set up two-factor when you first sign in from an invite link, or after an instance owner resets your sign-in.

1. On the **Set up two-factor** screen, add the key to an authenticator app such as Google Authenticator, 1Password or Authy. Select **Open in authenticator**, or select **Copy key** and paste the **Setup key** into the app.
2. Enter the **6-digit code** the app shows.
3. Select **Verify and enable**.
4. Blink shows your recovery codes. Save them somewhere safe, then select **I’ve saved them, continue**.

## Recovery codes

[Section titled “Recovery codes”](#recovery-codes)

You get 10 recovery codes. Each one works once, in place of a 6-digit code, if you lose your authenticator app. The **Account** page shows how many you have left.

To get a new set:

1. Open **Account**.
2. Under **Two-factor authentication**, select **New recovery codes**.
3. Enter the 6-digit code from your authenticator app and select **Make new codes**.
4. Save the new codes, then select **I’ve saved them**.

Your old codes stop working, and the new ones are not shown again.

## Passkeys

[Section titled “Passkeys”](#passkeys)

A passkey lets you sign in and confirm high-risk actions with your fingerprint, face, screen lock or a security key instead of typing a code. Passkeys can’t be phished. Your authenticator app stays as the fallback.

To add a passkey:

1. Open **Account**.
2. Under **Passkeys**, select **Add passkey**.
3. Enter a **Name**, for example the name of the laptop or security key, and select **Continue**.
4. Follow your browser’s prompt.

To remove a passkey, select the bin icon next to it. When you sign in with a passkey available, you can still choose **Use a code from your authenticator app instead**.

## Sign out everywhere

[Section titled “Sign out everywhere”](#sign-out-everywhere)

If you think a computer or phone you used was lost or stolen, open **Account** and select **Sign out of all devices**. **Sign out** signs out only the browser you are using.

## Lost authenticator or forgotten password

[Section titled “Lost authenticator or forgotten password”](#lost-authenticator-or-forgotten-password)

Users can’t change their own password or remove two-factor in the console. If you have no recovery codes left, or forgot your password, ask an instance owner to reset your sign-in. They send you a new link to choose a password and set up two-factor again. See [Reset a user’s sign-in](/configure/users/#reset-a-users-sign-in).

## How long a sign-in lasts

[Section titled “How long a sign-in lasts”](#how-long-a-sign-in-lasts)

A console sign-in lasts 30 days by default. After that, the browser has to sign in again with password and second factor, however active it was. Someone with the **Manage security settings** permission can change this to anything from 1 to 365 days. See [Sign-in lifetime](/configure/security-settings/#sign-in-lifetime).

## Confirming high-risk actions

[Section titled “Confirming high-risk actions”](#confirming-high-risk-actions)

Some actions ask for a fresh passkey or 6-digit code even though you are signed in, so a stolen sign-in alone can’t do them. These include opening a terminal, Backstage tools as SYSTEM, a Safe Mode reboot, Install Access, changes to roles, members, users and two-factor, changes to security settings, revoking or deleting a device, and changes to the instance identity and keys.

How long one confirmation lasts is an instance setting. See [Confirming high-risk actions](/configure/security-settings/#confirming-high-risk-actions).

## Too many wrong attempts

[Section titled “Too many wrong attempts”](#too-many-wrong-attempts)

Blink limits wrong passwords and wrong two-factor codes. Too many wrong codes for one account lock that account for a while, from every address except allowlisted ones. Too many wrong passwords lock that email from that address only, so nobody can lock you out from somewhere else. See [Rate limits](/configure/security-settings/#rate-limits).

# Choose the name customers see

> Set how the banner on the customer's computer names connected technicians, for the whole server or for one organization.

During a Support session, a banner on the customer’s computer shows who is viewing their screen, for example **Viewed by technician: Cody R.** You decide how technicians are named there. Unattended Access sessions show no banner.

There are two levels:

* An **instance default**, which applies in every organization that does not choose its own.
* An optional **organization override**, if the instance allows organizations to choose.

Changes apply to live sessions right away.

If your plan does not include Tech name

The name settings are read-only and say **Not included in your plan: Tech name. Customers see the default name.** The banner then names technicians by first name and last initial, in every organization. See [Understand your plan and its limits](/configure/plans-and-limits/).

## The naming options

[Section titled “The naming options”](#the-naming-options)

| Option                                    | Example                                                            |
| ----------------------------------------- | ------------------------------------------------------------------ |
| **First name and last initial (Cody R.)** | The default                                                        |
| **Full name (Cody Robinson)**             |                                                                    |
| **Custom text**                           | The same text for everyone, such as `Technician` or `A technician` |

Names come from the first and last names on each user’s account. Blink never shows a technician’s email address. For the name options, you can also enter **Text for technicians without a name (optional)**; if you leave it empty, Blink uses `A technician`.

Custom text can be up to 40 characters, must contain a letter or digit, can’t contain hidden or control characters, and can’t say that nobody is viewing. Blink removes such characters from users’ names too, so the banner can’t be faked.

## Set the instance default

[Section titled “Set the instance default”](#set-the-instance-default)

You need the **Instance settings** permission.

1. Open **Instance** › **Settings**.
2. Under **Customer-facing technician name**, choose an option under **Show technicians as**.
3. For **Custom text**, type the text or pick one of the quick choices.
4. Tick or clear **Let organizations choose their own**.
5. Check the preview, then select **Save**.

When **Let organizations choose their own** is off, every organization uses the instance setting. Their own choices are kept and come back if you turn it on again.

## Set a name for one organization

[Section titled “Set a name for one organization”](#set-a-name-for-one-organization)

You need the **Edit organization** permission in that organization.

1. Switch to the organization and open **Organizations**.
2. Under **Name shown to customers**, choose an option under **Show technicians as**. Choose **Use instance default** to follow the instance setting; the label shows what that currently is.
3. Check the preview, then select **Save**.

If the card says **Set by the instance administrator.**, the instance does not let organizations choose their own name.

# Add and manage users

> Create user accounts, send invite links, give people roles, and disable or reset accounts from the Users page.

A user is anyone who can sign in to your Blink console. Every user signs in with their email address, a password and a second factor. What a user can see and do depends on the roles you give them.

You manage users on the **Users** page, under **Instance** in the console sidebar. You need the **Manage users** permission to see it. Instance owners have it automatically.

## Create a user and send an invite

[Section titled “Create a user and send an invite”](#create-a-user-and-send-an-invite)

Blink does not send email invitations. Instead, you get an invite link and send it to the person yourself.

1. In the console, open **Users**.
2. Select **New user**.
3. Enter their **Email**, **First name** and **Last name**.
4. Select **Create and get link**.
5. In the **Invite link** dialog, select **Copy link** and send the link to the person, for example by email or chat.
6. Select **Done**.

The link is shown only once

The invite link works once and expires after 7 days. Blink does not show it again after you close the dialog. If it gets lost or expires, an instance owner can make a new one. See [Make a new invite link](#make-a-new-invite-link).

When the person opens the link, they see **Set up your account**. They choose a password of at least 8 characters, select **Set password**, and then set up two-factor sign-in with an authenticator app. See [Sign-in and two-factor authentication](/configure/sign-in-and-two-factor/).

A new user has no access to anything until you give them a role.

First and last names matter

Customers can see a technician’s name on the banner during a Support session. By default, Blink shows the first name and last initial. See [Choose the name customers see](/configure/technician-name/).

## Give a user a role

[Section titled “Give a user a role”](#give-a-user-a-role)

A user’s access is made up of roles, and each role is given for a scope. On the **Users** page you can give a role for:

* **All organizations, including future ones**: the role applies in every organization on your server, including organizations created later.
* **Selected organizations**: the role applies only in the organizations you tick.
* **One group in one organization**: the role applies only to the devices in one group. The user also becomes a member of that organization as **Member (group access only)** if they aren’t a member yet.

To give a role:

1. On the **Users** page, select the user’s row to expand it.
2. Under **Roles**, select **Give a role**.
3. Under **Where**, choose the scope. For **Selected organizations**, tick the organizations. For **One group in one organization**, choose the **Organization** and then the **Group**.
4. Choose the **Role**. The description of the role shows below the list.
5. Select **Save**.

To change or remove a role, expand the user’s row and use the pencil (**Change**) or bin (**Remove**) icon next to it. A group role can’t be moved to another group: remove it and give a new one.

Note

Some roles include instance permissions, such as managing users or security settings. Those permissions only apply when the role is given for **All organizations, including future ones**. If you choose **Selected organizations** for such a role, the console warns you.

The expanded row also lists the user’s **Organization memberships**. You change those on each organization’s **Team** and **Groups** pages. Select **Open team** to go straight to an organization’s team. See [Manage organizations and teams](/configure/organizations/) and [Limit access with groups](/configure/groups/).

For what each role allows, see [Roles and permissions](/configure/roles/).

## Read the user list

[Section titled “Read the user list”](#read-the-user-list)

| Column           | What it shows                                                                                 |
| ---------------- | --------------------------------------------------------------------------------------------- |
| **User**         | Name and email. **Instance owner** marks instance owners, and **you** marks your own account. |
| **Roles**        | Up to three roles with where they apply, plus a count of group roles.                         |
| **Two-factor**   | **on**, **not set up**, **invite pending** or **invite expired**.                             |
| **Status**       | **active** or **disabled**.                                                                   |
| **Last sign-in** | When the user last signed in, or **never**.                                                   |

Use the **All roles** and **Any scope** filters above the list to find, for example, every user with a given role, or every instance owner.

## Technician seats

[Section titled “Technician seats”](#technician-seats)

Your plan includes a number of technician seats. Every user account that is not disabled takes one, administrators and instance owners included, and so does a user whose invite is still pending. Disabled users don’t take a seat. See [Technician seats](/configure/plans-and-limits/#technician-seats).

If you have the **View license** permission, the top of the **Users** page shows how many seats are in use, for example **8 of 10 seats**. When every seat is in use, **New user** is greyed out with **All technician seats are in use. Remove or disable a user, or add seats to your plan.**

At the limit, Blink refuses to create a user or to enable a disabled one, with a message such as **Your plan includes 10 technician seats and 10 are in use. Technician seats: ask your provider to raise the limit.** A user you try to enable stays disabled. To free a seat, disable a user you no longer need.

If your plan changes to fewer seats than you use, nobody is locked out: everyone keeps signing in, but new users are refused until you are under the limit.

## Disable or enable a user

[Section titled “Disable or enable a user”](#disable-or-enable-a-user)

Disable a user when they leave or should no longer have access. Disabling keeps their account and roles, so you can turn them back on later.

1. On the **Users** page, find the user.
2. Select **Disable** at the end of their row.
3. Confirm with **Disable**.

The user is signed out everywhere at once and can’t sign in until you enable them again. To restore access, select **Enable** on the same row. Disabling a user frees their technician seat, and enabling them takes one again, so enabling is refused when every seat is in use.

* You can’t disable your own account.
* Only an instance owner can disable another instance owner.
* Your server always keeps at least one active instance owner.
* You can’t disable someone who is the only active **Owner** of an organization. Make someone else Owner there first.

Blink has no option to delete a user. Disable the account instead.

## Reset a user’s sign-in

[Section titled “Reset a user’s sign-in”](#reset-a-users-sign-in)

Reset a user’s sign-in when they have forgotten their password or lost their authenticator app. Only instance owners can do this.

1. On the **Users** page, select the user’s row to expand it.
2. Select **Reset sign-in**.
3. Confirm with **Reset sign-in**.
4. In the **Sign-in reset** dialog, select **Copy link** and send the link to the user.

The reset removes the user’s password, two-factor setup, passkeys and recovery codes, and signs them out everywhere. Their roles stay. With the new link, they choose a new password and set up two-factor again.

Users can’t change their own password in the console. A reset is how they get a new one. You can’t reset your own account: ask another instance owner.

Note

Every reset raises an owner alert. See [Owner alerts and webhooks](/configure/alerts/).

### Make a new invite link

[Section titled “Make a new invite link”](#make-a-new-invite-link)

If a user hasn’t accepted their invite yet, the expanded row shows **New invite link** instead of **Reset sign-in**. Select it and confirm with **Make new link**. The old link stops working.

## Instance owners

[Section titled “Instance owners”](#instance-owners)

Instance owners have every instance permission, including **View license**, and almost every permission in every organization, including managing users and other instance owners. The exceptions are in the note below. The person who set up your Blink server is the first instance owner.

To make someone an instance owner, expand their row on the **Users** page and select **Make instance owner**. To take it away, select **Remove instance owner**. Only instance owners see these buttons.

Caution

Keep the number of instance owners small. Making someone an instance owner raises an owner alert.

Terminal and Backstage as SYSTEM

Opening a remote terminal and running Backstage tools as SYSTEM are granted only by a role that includes them, such as an organization’s **Owner** role. Being an instance owner alone does not grant them. See [Roles and permissions](/configure/roles/#permissions-granted-on-their-own).

# Get started

> Start here: what IZT Blink is, setting it up, and your first Support session and Access device.

This section takes you from your Blink address to your first remote session. Work through the pages in order. On Blink Cloud, skip the license page: your license is activated for you.

## Learn what Blink does

[Section titled “Learn what Blink does”](#learn-what-blink-does)

* [What IZT Blink is](/get-started/what-is-blink/): attended Support sessions by code and unattended Access to the computers you manage, in the cloud or on-premises.

## Set up your instance

[Section titled “Set up your instance”](#set-up-your-instance)

1. [Set up Blink and sign in for the first time](/get-started/first-sign-in/): the Blink Cloud setup email or the setup token on your own server, the owner account, two-factor authentication and the recovery kit.
2. [Activate your license](/get-started/activate-your-license/): on your own server, online with an activation code or offline with a license file.
3. [Find your way around the console](/get-started/console-tour/): organizations, Access, Sessions, Recordings, Team and the instance pages.
4. [Invite your team](/get-started/invite-your-team/): create accounts, send invite links and give roles.

## Run your first sessions

[Section titled “Run your first sessions”](#run-your-first-sessions)

* [Run your first Support session](/get-started/first-support-session/): create a code, have a customer join on Windows or Mac, take control and end the session.
* [Set up your first Access device](/get-started/first-access-device/): create an enrollment key, install the agent on a Windows computer and connect to it.

## Where to go next

[Section titled “Where to go next”](#where-to-go-next)

* [Install](/install/) for server setup, licenses and rolling out agents.
* [Configure](/configure/) for users, organizations, roles, groups and sign-in security.
* [Use Blink](/use/) for sessions, the viewer and its tools, and recordings.
* [Troubleshooting](/troubleshooting/) when something does not work.

Stuck on a step? Ask the AI assistant or contact [IZT](https://izt.app).

# Activate your license

> Activate an on-premises Blink instance online with your activation code, or offline with a license file from the IZT license portal.

A Blink license is signed by IZT for your instance. It sets the hostname your agents connect to and your plan: **Blink Core** or **Blink Pro**, and how many technician seats and Access devices you have. Until the instance is activated, nothing in the plan is available: you cannot create Support codes, enroll devices or add users, and the instance cannot fetch agents from IZT or build installers. Activate it before your first session.

On Blink Cloud

You do not need to do anything. Blink Cloud activates your license by itself once [setup](/get-started/first-sign-in/) is finished. You can see it under **Instance** › **License**, where the hostname is marked **Managed by Blink Cloud**.

Only the instance owner can activate a license. You need:

* the **activation code** IZT sent you. It looks like `BLINK-XXXXX-XXXXX-XXXXX-XXXXX`.
* the **hostname** your agents use to reach this server, for example `blink.example.com`.

## Open the License page

[Section titled “Open the License page”](#open-the-license-page)

1. Sign in to the console.
2. Go to **Instance** › **License**.

The **License** card shows **Not activated** and your instance id. Below it, the **Activate** card has a **Hostname** field and two ways to activate: **Online** and **Offline**.

## Choose the hostname

[Section titled “Choose the hostname”](#choose-the-hostname)

Type the hostname in **Hostname**, in lowercase, as a full domain name such as `blink.example.com`. An IP address also works.

* If agents reach the server on a port other than 443, add it: `blink.example.com:8443`.
* The hostname is locked into the license and built into every agent. Changing it later means activating again.

## Activate online

[Section titled “Activate online”](#activate-online)

Use this when the server can reach IZT over the internet. The server needs outbound access to:

| Host                    | Port    |
| ----------------------- | ------- |
| `license.blink.izt.app` | 443/TCP |
| `build.blink.izt.app`   | 443/TCP |

Allow both through your firewall and any proxy before you start. The same access keeps the license renewing by itself and lets agents download and update.

1. In **Online**, paste your code into **Activation code**. Spaces and lowercase letters are fine.
2. Click **Activate**.
3. If a **Confirm it’s you** dialog opens, confirm with your passkey or a code from your authenticator.

The page shows **License activated** and the **License** card turns **Active**. An online license renews by itself: the card shows when under **Renews**, and **Renew now** renews it on the spot.

If the **Online** section says this server does not reach the IZT build service, use the offline steps.

## Activate offline

[Section titled “Activate offline”](#activate-offline)

Use this when the server cannot reach the internet. You move two small files between the server and the IZT license portal, `license.blink.izt.app`, from any computer that has internet access.

1. Under **Offline**, click **Activation request**. A request file for the hostname above downloads.
2. On a computer with internet access, open `license.blink.izt.app` and go to its activation page.
3. Enter your activation code and upload the request file. The portal shows what the file asks for. Confirm it.
4. The portal returns a **license file**. Save it.
5. Back in the console, under **Offline**, click **License file** and choose the file you saved.

The page shows **License imported** and the **License** card turns **Active**.

Tip

Use a request file within 30 days of downloading it. After that, download a new one.

## Check your plan

[Section titled “Check your plan”](#check-your-plan)

After activation, the **License** card shows your **Plan**, your **Technician seats** and **Access devices**, and below them a checklist of what your plan includes. See [Understand your plan and its limits](/configure/plans-and-limits/).

Blink View

If your license includes Blink View, an online activation lets customers enter a 6-digit code on `view.blink.izt.app`. After an offline activation, customers get a direct link or QR code from you instead. Activating or renewing online later switches to codes. See [Online and offline instances](/use/blink-view/#online-and-offline-instances).

## Check that agents are available

[Section titled “Check that agents are available”](#check-that-agents-are-available)

After activation, the **Agent builds** card on the same page lists the agents this server hands out, and shows **Updates on**. Click **Check now** to fetch the latest agents straight away instead of waiting for the next automatic check.

Once a version appears, customers can download the support tool, and you can build Access installers.

## Renewal, grace and lapse

[Section titled “Renewal, grace and lapse”](#renewal-grace-and-lapse)

* **Online**, the license renews automatically before it expires.
* **Offline**, renew it with the same exchange: download a new **Activation request**, upload it on the portal’s Renew page (no code needed), and import the license file it returns.

If a license expires without being renewed, the console shows a banner and the License card shows **Expired, in grace**. During the 30-day grace, everything keeps working. After the grace, the license is **Lapsed**: Blink stops getting new agent builds and updates, but everything in your plan keeps working: your installed agents keep connecting, and Support sessions and new enrollments keep working.

See [Install](/install/) for more on licenses, renewal and offline agent updates.

# Find your way around the console

> A tour of the Blink technician console, from the organization switcher to Access, Sessions, Recordings, Team and Instance.

The console is where your team works. Open it by signing in at `/login` on your Blink address.

## The top bar

[Section titled “The top bar”](#the-top-bar)

* **Organization.** The name of the organization you are working in, and your role in it. If you belong to more than one, click it to switch, search your organizations, or choose **Overview** to see all of them at once.
* **Alerts.** Instance owners see a bell with security alerts about the instance, such as new administrators, two-factor resets and role changes.
* **Help.** **Send diagnostics to IZT** and **Sent diagnostics**, for people who may send logs to IZT Support. See [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/).
* **Your name.** Opens a menu with **Account** and **Sign out**.

On a narrow screen the sidebar folds away. Open it with the menu button at the top left.

Banners under the top bar tell you when something needs attention, for example a license that has expired or more users than your plan’s technician seats. On Blink Cloud, IZT can also post notices there.

## The sidebar

[Section titled “The sidebar”](#the-sidebar)

The sidebar shows only the pages you have permission to use and your plan includes (see [Understand your plan and its limits](/configure/plans-and-limits/)). When **Overview** is selected in the organization switcher, it leaves out the pages that belong to a single organization.

### Remote

[Section titled “Remote”](#remote)

| Page           | What it is for                                                                                                                                                                      |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Overview**   | Devices and sessions across every organization you can reach. Shown when you choose **Overview** in the organization switcher.                                                      |
| **Access**     | Computers with the Blink agent installed. See which are online, and click **View** to connect.                                                                                      |
| **Sessions**   | Support codes and Access connections, live and past. Create a **Support code** here, join a live session, open its recording or session log (when your plan keeps them), or end it. |
| **Recordings** | Every session’s video, per monitor, with its audio, and terminal transcripts, when your plan includes them. Running sessions can be watched live.                                   |
| **Activity**   | Who did what: changes and sessions, newest first. Not shown when your plan does not include **Audit log**.                                                                          |

### Organization

[Section titled “Organization”](#organization)

These pages apply to the organization selected in the top bar.

| Page              | What it is for                                                                                                                                                                                     |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Team**          | Who can sign in to this organization and their role. Add, suspend or remove members.                                                                                                               |
| **Groups**        | Groups of devices, and who can reach them. Use groups to give someone access to some devices but not others.                                                                                       |
| **Roles**         | Named sets of permissions you give to members or on a group.                                                                                                                                       |
| **Enrollment**    | Keys and installers that add computers to this organization for Access. Not shown when your plan does not include **Unattended Access**.                                                           |
| **Organizations** | Your organizations. Use one organization per customer, each with its own team, groups and devices. Create new ones here with **New organization**, if you have permission to create organizations. |

### Instance

[Section titled “Instance”](#instance)

These pages cover your whole Blink instance, across every organization.

| Page         | What it is for                                                                                                                                                                     |
| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Users**    | Everyone who can sign in, and which organizations and groups they reach. Create new users here.                                                                                    |
| **Instance** | Tabs for **Roles**, **Organizations**, **Settings**, **License**, **Identity**, **Certificates**, **Security** and **Activity**. **License** shows your plan and what it includes. |

On Blink Cloud, some instance settings, such as certificates, are looked after by IZT. The console shows them as **Managed by Blink Cloud** instead of letting you change them.

### You

[Section titled “You”](#you)

| Page        | What it is for                                                                                                          |
| ----------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Account** | Your profile, two-factor authentication, new recovery codes, passkeys, and **Sign out** or **Sign out of all devices**. |

## Where customers go

[Section titled “Where customers go”](#where-customers-go)

Customers never use the console. They go to your Blink address itself (or `/join`), where the page says **Join a support session** and asks for the code you give them. That page also has a **Technician sign in** link for your team.

## Next

[Section titled “Next”](#next)

* [Invite your team](/get-started/invite-your-team/)
* [Run your first Support session](/get-started/first-support-session/)

# Set up your first Access device

> Create an enrollment key, install the Blink agent on a Windows computer, and connect to it from the console without anyone at the keyboard.

Access is unattended remote access to the computers you manage. You install the Blink agent on a computer once. From then on it shows in the console under **Access**, and you can connect whenever it is online, whether or not anyone is there.

The Access agent runs on Windows. It installs as a service that starts automatically with Windows.

Before you start:

* You can sign in to the console with a role that lets you create enrollment keys and connect to devices. The owner and **Admin** roles can.
* On your own server, the license is active and the **Agent builds** card lists agents. See [Activate your license](/get-started/activate-your-license/).
* Your plan includes **Unattended Access** and has a free Access device: each enrolled computer takes one. See [Access devices](/configure/plans-and-limits/#access-devices).
* You can run programs as administrator on the Windows computer.

## 1. Create an enrollment key

[Section titled “1. Create an enrollment key”](#1-create-an-enrollment-key)

An enrollment key lets the agent register a computer into one organization.

1. Select the organization in the top bar.

2. In the sidebar, go to **Enrollment**.

3. Click **New key**.

4. Fill in the key’s details:

   * **Label**: a name to recognize it by, for example `Acme HQ rollout, Oct`.
   * **Seed group**: optional. Computers enrolled with this key join this group.
   * **Max uses**: how many computers can enroll with it. `0` means unlimited.
   * **Expires in days**: from 1 to 365. The default is 90.

5. Click **Create key**.

The **New key · shown once** card appears.

Copy it now

The key is shown only once. Blink keeps only a hash of it, so it cannot show it again. Anyone who has the key, or an installer built with it, can enroll a computer into your organization until it expires or is used up. Prefer one key per rollout, with a small **Max uses** and a short expiry.

## 2. Get the agent onto the computer

[Section titled “2. Get the agent onto the computer”](#2-get-the-agent-onto-the-computer)

The card offers two ways. Use whichever suits you.

### The installer (simplest)

[Section titled “The installer (simplest)”](#the-installer-simplest)

1. Click **Download installer**. Blink builds a signed agent with this key built in.
2. Copy the installer to the Windows computer.
3. On that computer, right-click the installer and choose **Run as administrator**.

It installs and enrolls with no further questions.

### The agent and a command

[Section titled “The agent and a command”](#the-agent-and-a-command)

1. Click **Agent** to download the agent, `blink-agent.exe`, and copy it to the Windows computer.

2. Click **Copy** next to the command. It looks like this, with your key in it:

   ```plaintext
   blink-agent.exe --install --enroll <key>
   ```

3. On that computer, open a Command Prompt or PowerShell as administrator, go to the folder with `blink-agent.exe`, and run the command.

This way suits scripted rollouts, because the same agent file works with any key.

Note

If the card says **No agent release yet, so there is nothing to download**, the instance has no agents to hand out. On your own server, go to **Instance** › **License** and click **Check now** under **Agent builds**.

## 3. Find the computer in the console

[Section titled “3. Find the computer in the console”](#3-find-the-computer-in-the-console)

1. In the sidebar, go to **Access**.
2. The computer appears in the list, by name, with **online now** under it.

## 4. Connect

[Section titled “4. Connect”](#4-connect)

1. Click **View** on the computer’s row. The viewer opens in a new tab.
2. If the console asks you to confirm it’s you, switch back to the console tab and confirm with your passkey or a code from your authenticator.

You now see the computer’s screen and control it. Unlike Support sessions, Access sessions do not ask you to confirm the computer first.

## 5. End the session

[Section titled “5. End the session”](#5-end-the-session)

In the viewer, click **End**, then **End session**. Every technician viewing the computer is disconnected and, if the session is recorded, the recording is finalized.

The agent stays installed and the computer stays in **Access**, ready for next time. Like Support sessions, Access sessions are listed under **Sessions**. The recording and the session log are kept when your plan includes **Session recording** and **Session timeline** (Blink Pro): see [Blink Core and Blink Pro](/configure/plans-and-limits/#blink-core-and-blink-pro).

Install Access during a Support session

Already helping someone in a Support session on Windows? Click **Install Access** in the viewer to install the agent on their computer and enroll it into your organization, without a separate key. Confirm the computer first. The support tool also has to run as administrator: if it does not yet, the viewer offers **Run as admin**, and the customer answers a one-time Windows prompt with **Yes**.

See [Install](/install/) for rolling the agent out to many computers, and [Use Blink](/use/) for everything you can do with an Access device.

# Set up Blink and sign in for the first time

> Create the owner account, turn on two-factor authentication and save the recovery kit, on Blink Cloud or on your own server.

A new Blink instance has no accounts. The first person to finish the setup page becomes its **owner**: the account with every permission, in the instance and in your first organization. Setup has four parts:

1. Create the owner account and your first organization.
2. Turn on two-factor authentication and save your recovery codes.
3. Create and save the recovery kit.
4. Prove the saved kit opens.

Before you start, have these ready:

* An authenticator app on your phone or computer (Google Authenticator, 1Password, Authy or similar).
* A password manager, or another safe place for a passphrase.
* Somewhere offline to keep two small files, such as a USB drive kept in a safe.

## Get your setup link and token

[Section titled “Get your setup link and token”](#get-your-setup-link-and-token)

Setup happens at `/setup` on your Blink address, for example `https://yourname.onblink.cloud/setup`. The page asks for a **setup token**, which proves you are the person allowed to claim this instance.

### On Blink Cloud

[Section titled “On Blink Cloud”](#on-blink-cloud)

When your instance is ready, IZT emails your contact address. The email’s subject is **Set up your Blink instance** followed by your instance name. It contains:

* the setup link, ending in `/setup`,
* the setup token,
* the date and time (UTC) the token is valid until.

The setup token expires

Use the token before the time in the email. After that it is refused, and setup cannot go on until IZT sends you a new link. If yours has expired, contact IZT and ask for a new setup link.

### On your own server

[Section titled “On your own server”](#on-your-own-server)

The Blink server prints the setup token as `setup_token` in its log and console when it starts and has no accounts yet. Copy it from there. This token does not expire, and it stops working as soon as the owner account exists. If the server restarts before setup is done, it prints a new token: use the latest one. See [Install](/install/) for setting up the server itself.

## 1. Create the owner account

[Section titled “1. Create the owner account”](#1-create-the-owner-account)

1. Open the setup link (or go to `/setup` on your Blink address). The page shows **Set up Blink**.
2. Fill in **First name**, **Last name**, **Email** and **Password** (at least 8 characters), then type the password again in **Confirm password**.
3. In **Organization**, type the name of your company or team. This becomes your first organization, and you are its Owner.
4. In **Setup token**, paste the token from the email or the server log.
5. Click **Create owner account**.

If the page says **That setup token doesn’t match**, copy the token again. On your own server, make sure it is the latest one the server printed. On Blink Cloud, check that the time in the email has not passed.

Note

Once setup is finished, `/setup` sends you to the sign-in page.

## 2. Turn on two-factor authentication

[Section titled “2. Turn on two-factor authentication”](#2-turn-on-two-factor-authentication)

Every Blink account signs in with a password and a second factor. The owner sets it up right away.

1. The page shows **Set up two-factor** and a **Setup key**.
2. Add the key to your authenticator app. Click **Open in authenticator** if your device offers it, or click **Copy key** and paste the key into the app.
3. Type the 6-digit code the app shows into **6-digit code**, then click **Verify and enable**.
4. The page shows **Two-factor enabled** and 10 recovery codes. Each one signs you in once if you lose your authenticator. They are not shown again.
5. Click **Copy codes** and store them in your password manager, then click **I’ve saved them, continue**.

You can add a passkey later, under **Account**, as a faster second factor.

## 3. Create the recovery kit

[Section titled “3. Create the recovery kit”](#3-create-the-recovery-kit)

The recovery kit is two files locked with a passphrase you choose:

* **Recovery key**: replaces this instance’s identity if it is ever lost or stolen.
* **Database key backup**: a backup of the key that protects every secret Blink stores.

Blink keeps neither file. Without them, a lost instance means reinstalling every Access agent.

1. On **Recovery kit**, type a passphrase of at least 12 characters in **Passphrase** and again in **Confirm passphrase**.
2. Click **Create recovery kit**. Encrypting the kit takes a moment.
3. On **Save the kit**, click **Download** next to **Recovery key** and next to **Database key backup**. Each row also shows the file’s checksum.
4. Click **I’ve saved both, continue**.

Store the passphrase apart from the files

Keep the two files offline, away from your backups, and the passphrase in your password manager. Nobody, IZT included, can recover a lost passphrase. The files are shown only now: if you lose them before you finish, click **Start over with another passphrase**.

## 4. Prove the kit opens

[Section titled “4. Prove the kit opens”](#4-prove-the-kit-opens)

Blink asks you to show that each saved file is the right one before it finishes setup.

1. **Check the database key backup** (step 1 of 2): with **Open the saved file** selected, click **Choose the backup…**, pick the database key backup you saved, enter the passphrase and click **Continue**.
2. **Check the recovery file** (step 2 of 2): click **Choose the recovery file…**, pick the recovery key file, enter the passphrase and click **Finish setup**.

The file and the passphrase are opened in your browser to prove they work. Neither is sent to the server.

If you cannot open a file, you can switch to **Type its checksum** and type the `checksum` value from the file instead. That only proves you can read the file, not that the passphrase works, so opening the file is the better check.

When setup finishes, the console opens.

If setup is interrupted

If you close the browser after creating the owner account, go back to `/setup`. Blink asks you to sign in with the owner account, then picks up at the recovery kit. Until the kit is confirmed, the sign-in page sends you back to `/setup`, and you cannot activate a license.

## Sign in from now on

[Section titled “Sign in from now on”](#sign-in-from-now-on)

1. Go to `/login` on your Blink address. From the join page, click **Technician sign in**.

2. Enter your **Email** and **Password** and click **Continue**.

3. Confirm with your second factor:

   * With a passkey: click **Sign in with passkey** and confirm with your fingerprint, face, screen lock or security key.
   * With your authenticator: on **Two-factor code**, enter the 6-digit code, or one of your recovery codes, in **Code** and click **Sign in**.

Sensitive actions, such as activating a license, can ask you again. A **Confirm it’s you** dialog opens: confirm with your passkey or a fresh code from your authenticator.

## Next

[Section titled “Next”](#next)

* On your own server: [activate your license](/get-started/activate-your-license/).
* On Blink Cloud: your license is activated for you. Continue with the [console tour](/get-started/console-tour/).

# Run your first Support session

> Create a Support code, walk your customer through joining on Windows or Mac, take control, and end the session.

A Support session is attended help: someone at a Windows PC or a Mac asks for help and lets you in with a one-time code. Nothing is installed on their computer.

This walkthrough takes you from creating a code to ending the session. To try it on your own, use a second computer as the “customer”.

Before you start:

* You can sign in to the console and have a role that lets you create Support sessions, such as **Technician**. See [Invite your team](/get-started/invite-your-team/).
* On your own server, the license is active and the **Agent builds** card lists agents. See [Activate your license](/get-started/activate-your-license/).

## 1. Create a Support code

[Section titled “1. Create a Support code”](#1-create-a-support-code)

1. Sign in to the console and select the organization the customer belongs to.
2. In the sidebar, go to **Sessions**.
3. Click **Support code**.
4. Optionally, give it a **Label**, for example `Printer at front desk`, so you can tell sessions apart later. If your organization uses groups, you may also be asked to choose a **Group**.
5. Click **Create code**.

A card appears with **Give the customer this code**, the code in large type, and buttons to **Copy code** and **Copy join link**.

Codes expire

An unused code expires 15 minutes after you create it. The card shows the exact time. Each code works once. By default a code is nine digits; your administrator can change the format.

## 2. Send the customer to the join page

[Section titled “2. Send the customer to the join page”](#2-send-the-customer-to-the-join-page)

Tell the customer, by phone or chat:

1. Open your Blink address in a browser, for example `https://yourname.onblink.cloud`. The page says **Join a support session**.
2. Type the code and click **Download the support tool**.

**Copy join link** copies the address of the join page (your Blink address followed by `/join`), ready to paste into a chat. The customer still types the code.

## 3. The customer runs the support tool

[Section titled “3. The customer runs the support tool”](#3-the-customer-runs-the-support-tool)

The join page detects whether the customer is on Windows or a Mac and gives them the right tool, with steps to follow.

### On Windows

[Section titled “On Windows”](#on-windows)

1. Open the downloaded file. Its name starts with `blink-` and ends in `.exe`.
2. If Windows shows a warning, choose **More info**, then **Run anyway**.
3. Keep the window open while you work. Closing it ends the session.

### On a Mac

[Section titled “On a Mac”](#on-a-mac)

1. Open the downloaded app from **Downloads**. Safari unzips it automatically. In other browsers, double-click the zip first.
2. If macOS will not open it, go to **System Settings** › **Privacy & Security** and choose **Open Anyway**.
3. When macOS asks, allow **Screen Recording** and **Accessibility** for Blink, so you can see and use the screen.
4. Blink shows in the menu bar while the session is live. The customer chooses **End session** there to stop.

Caution

Support works on Windows PCs and Macs, not on an iPad. A customer who opens the join page on an iPad is asked to use a computer instead.

## 4. Connect

[Section titled “4. Connect”](#4-connect)

When the tool connects, the session’s row on the **Sessions** page shows it as connected, with the remote computer’s screen size.

1. Click **View** on the session’s row. The viewer opens in a new tab.
2. The viewer asks **Is this your customer’s computer?** and shows the computer’s name, the signed-in user and the operating system. Check them with the customer.
3. Click **Confirm and take control**.

Until you confirm, your mouse, keyboard, clipboard and files do not reach the computer. If the customer does not recognize the details, end the session.

You now see the customer’s screen and control it. The viewer’s toolbar has buttons to switch monitors, send files and change quality, and the bottom strip shows the connection’s frame rate and bitrate. See [Use Blink](/use/) for every viewer tool.

## What the customer sees

[Section titled “What the customer sees”](#what-the-customer-sees)

On Windows, a banner sits at the top of each screen you watch. It says a technician is viewing the screen, shows a **Recording** indicator, and has **End** and **Hide** buttons, plus **Send file** while the support tool is not running as administrator. The customer can drag it anywhere on the screen. On a Mac, Blink shows in the menu bar.

## 5. End the session

[Section titled “5. End the session”](#5-end-the-session)

Any of these ends it:

* In the viewer, click **End**, then **End session**. The support tool on the customer’s computer closes and, if the session is recorded, the recording is finalized.
* On the **Sessions** page, click **End** on the session’s row, then **End session**.
* The customer clicks **End** on the banner, closes the tool on Windows, or chooses **End session** in the menu bar on a Mac.

## 6. Find the recording and log

[Section titled “6. Find the recording and log”](#6-find-the-recording-and-log)

The session stays on the **Sessions** page after it ends. With Blink Pro, every session is recorded automatically and keeps a session log: the session’s row has buttons for its recording and its log, and you can also find the recording under **Recordings**. On Blink Core, sessions are not recorded and keep no log. See [Understand your plan and its limits](/configure/plans-and-limits/#blink-core-and-blink-pro).

## If something goes wrong

[Section titled “If something goes wrong”](#if-something-goes-wrong)

* **“That code was not found or has expired.”** The customer typed it wrong, or more than 15 minutes have passed. Create a new code.
* **“The support tool is not available yet.”** The instance has no support tool to hand out yet. On your own server, check **Instance** › **License**.
* **“The download did not start.”** Ask the customer to enter the code again, or create a new one.

See [Troubleshooting](/troubleshooting/) for more.

# Invite your team

> Create Blink accounts for your technicians, send them their invite links, and give them a role in your organization.

Each technician signs in with their own Blink account. Inviting someone takes two steps: create their account, which gives you an invite link to send them, then give them a role so they can reach your organization.

You need the **Manage users** permission. As the instance owner, you have it.

## 1. Create the user

[Section titled “1. Create the user”](#1-create-the-user)

1. In the sidebar, go to **Users**.
2. Click **New user**.
3. Enter their **Email**, and optionally their **First name** and **Last name**.
4. Click **Create and get link**.
5. The **Invite link** dialog shows the link. Click **Copy link** and send it to them, by email or chat.
6. Click **Done**.

The link is shown once

The invite link works once, for 7 days. The dialog shows the exact date. Blink does not show the link again and does not email it for you. If it gets lost or expires, an instance owner opens the user’s row under **Users** and clicks **New invite link**.

Each user takes a technician seat

Every user takes one of the technician seats in your plan, including people who have not accepted their invite yet. The top of the **Users** page shows how many are in use. If **New user** is greyed out, all seats are in use: disable a user you no longer need, or ask for more seats. See [Technician seats](/configure/plans-and-limits/#technician-seats).

## 2. Give them a role

[Section titled “2. Give them a role”](#2-give-them-a-role)

A new user cannot reach any organization until you give them a role. The simplest way is to add them to the organization’s team:

1. Select the organization in the top bar.
2. In the sidebar, go to **Team**.
3. Click **Add member**.
4. Enter their **Email**.
5. Choose a **Role**. The text under the list describes what the role allows.
6. Click **Add member**.

The person must already have a Blink account, which step 1 created. You can add them before they have accepted the invite.

New instances come with these roles. **Owner** is built in; the others are starter roles that administrators can edit or delete:

| Role                           | What it allows                                                                                                     |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
| **Owner**                      | Everything in the organization.                                                                                    |
| **Admin**                      | Everything except renaming or deleting the organization, managing owners, terminal access and backstage as SYSTEM. |
| **Technician**                 | Support and Access sessions, device control and recordings. This is the default choice.                            |
| **Viewer**                     | Watch sessions, see devices, play recordings and read logs.                                                        |
| **Member (group access only)** | Nothing organization-wide. They reach only the device groups you give them a role on, under **Groups**.            |

Someone who works across all your customers

To give a person the same role in every organization, including ones you add later, go to **Users**, open their row, and click **Give a role**. Choose **All organizations, including future ones**, pick the role and click **Save**.

## What your teammate does

[Section titled “What your teammate does”](#what-your-teammate-does)

1. They open the invite link. The page shows **Set up your account**, with their email already filled in.
2. They choose a password of at least 8 characters, type it twice and click **Set password**.
3. On **Set up two-factor**, they add the setup key to an authenticator app, enter the 6-digit code and click **Verify and enable**.
4. They save their 10 recovery codes and click **I’ve saved them, continue**.

The console opens. From then on they sign in at `/login` on your Blink address.

If the link was already used, has expired or was not copied whole, they see **Invite link not valid**. Make them a new one as described above.

## When someone forgets their password

[Section titled “When someone forgets their password”](#when-someone-forgets-their-password)

Blink has no self-service password reset. An instance owner opens the user’s row under **Users** and clicks **Reset sign-in**. This removes their password, two-factor and recovery codes, signs them out everywhere, and gives you a new invite link to send them.

See [Configure](/configure/) for more on users, roles, groups and sign-in security.

# What IZT Blink is

> IZT Blink in one page. Attended Support sessions by code, unattended Access to the computers you manage, in the cloud or on-premises.

IZT Blink is remote support for help desks, IT teams and managed service providers. Your technicians work from a browser. The people and computers they help are on Windows or Mac.

Blink does two jobs:

|                                | Support                                                                                                                              | Access                                                                                                                          |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| **What it is**                 | Attended help. Someone at the computer asks for help and lets you in.                                                                | Unattended access to computers you manage, whether or not anyone is there.                                                      |
| **How it starts**              | You create a Support code in the console. The customer enters it on your Blink address and runs the small support tool it downloads. | You install the Blink agent once on the computer with an enrollment key. From then on it shows in the console under **Access**. |
| **What stays on the computer** | Nothing is installed. Closing the tool ends the session.                                                                             | The agent stays installed and starts with Windows.                                                                              |
| **Platforms**                  | Windows and Mac                                                                                                                      | Windows                                                                                                                         |

## What every session gets

[Section titled “What every session gets”](#what-every-session-gets)

* **Screen and control.** You see every monitor of the remote computer in your browser and use its mouse and keyboard. Clipboard, file transfer and typing text into password fields are built into the viewer.
* **Transparency for the customer.** During a Support session on Windows, a banner on each screen you watch says a technician is viewing it, shows a **Recording** indicator, and has an **End** button. On a Mac, Blink shows in the menu bar, where the customer can choose **End session**.
* **A recording** (Blink Pro). Every monitor you watch is recorded automatically, with the session’s audio as a separate file. You can watch a recording while the session is still running.
* **A log** (Blink Pro). Every session has its own timeline and session log, open from the session’s row in the console.
* **A check before control.** In a Support session, the viewer first shows you the computer’s name, the signed-in user and the system, and asks **Is this your customer’s computer?** Your mouse, keyboard, clipboard and files reach it only after you click **Confirm and take control**.

## Plans

[Section titled “Plans”](#plans)

Blink comes in two plans, **Blink Core** and **Blink Pro**. Blink Pro adds session recording, terminal history and the session timeline. Your plan also sets how many technician seats and Access devices you have. See [Understand your plan and its limits](/configure/plans-and-limits/).

With the Blink View add-on, a customer can also show you their phone camera from a web page on the phone during a session. See [See the customer’s phone camera with Blink View](/use/blink-view/).

## Organizations, teams and roles

[Section titled “Organizations, teams and roles”](#organizations-teams-and-roles)

Blink keeps work separated by **organization**: one per customer, each with its own team, groups and devices. People sign in with their own Blink account, always with two-factor authentication. What each person can do is set by **roles**, given for a whole organization or for one group of devices.

## Cloud or on-premises

[Section titled “Cloud or on-premises”](#cloud-or-on-premises)

Blink is available in the cloud or on-premises. Either way, you reach it at **your Blink address**, for example `https://yourname.onblink.cloud`. That one address serves:

* the **join page**, at the address itself and at `/join`, where customers enter a Support code,
* the **technician console**, where your team signs in at `/login`.

The two differ only in setup:

* **Blink Cloud.** IZT runs Blink for you. You get an email with a setup link, and your license is activated for you once setup is done.
* **On-premises.** Blink runs on your own server. You activate the license yourself, online with an activation code or offline with a license file.

## Next

[Section titled “Next”](#next)

* [Set up Blink and sign in for the first time](/get-started/first-sign-in/)
* [Run your first Support session](/get-started/first-support-session/)

# Install

> Set up a Blink server on your own hardware, get its certificates right, and put Blink on the computers you support.

This section covers everything that has to be installed before you can help anyone: the Blink server (only if you run Blink on premises), its certificates, the Access agent on the computers you look after, and the support tool your customers run for a one-off session.

Using Blink in the cloud?

IZT runs the server for you, so skip the server pages. Your Blink address (for example `https://yourname.onblink.cloud`) is ready to use, and its certificates are issued and renewed for you. Start at [Check supported systems](/install/supported-systems/), then go straight to the agents.

## Before you start

[Section titled “Before you start”](#before-you-start)

* [Check supported systems](/install/supported-systems/): which computers Blink runs on, and what the network has to allow.

## Your Blink server (on premises only)

[Section titled “Your Blink server (on premises only)”](#your-blink-server-on-premises-only)

* [Install Blink on your own server](/install/on-premises-server/): server and storage requirements, DNS name, ports, data, first start and the recovery kit.
* [Set up certificates](/install/certificates/): Let’s Encrypt from the console, your own certificate, and the built-in one.
* [Back up and restore the server](/install/back-up-and-restore/): what to back up, and how to bring a server back on new hardware.
* [Upgrade the server](/install/upgrade-the-server/): move to a new server version safely.

## Access agent (unattended computers)

[Section titled “Access agent (unattended computers)”](#access-agent-unattended-computers)

* [Create an enrollment key](/install/enrollment-keys/): the key that lets an agent join your organization.
* [Install the Access agent on Windows](/install/access-agent-windows/): signed installer, command line for scripted rollouts, or straight from a support session.
* [Deploy the Access agent with your RMM tool](/install/deploy-with-rmm/): ready-made scripts and steps for NinjaOne, Datto RMM, N-able, ConnectWise, Kaseya, Atera, Syncro, Intune, Configuration Manager, Group Policy and more, and how to switch from your old remote access tool.
* [Keep agents up to date](/install/agent-updates/): how updates reach your computers and what the console shows.
* [Uninstall the Access agent](/install/uninstall-the-agent/): remove it from a computer and clean up the console.

## Support tool (one-off sessions)

[Section titled “Support tool (one-off sessions)”](#support-tool-one-off-sessions)

* [Run the support tool](/install/support-tool/): what your customer downloads and runs, on Windows and Mac.
* [Allow Blink on a Mac](/install/mac-permissions/): the macOS privacy settings Blink needs to see and control the screen.

When everything is installed, carry on with [Configure](/configure/) or [Use Blink](/use/). If something does not work, see [Troubleshooting](/troubleshooting/) or ask the AI assistant.

# Install the Access agent on Windows

> Put the Access agent on a Windows computer with the signed installer, a command line for scripted rollouts, or straight from a support session.

The Access agent makes a Windows computer reachable from the console at any time, without anyone at the keyboard. It installs as a Windows service named **IZT Blink Agent** (service name `BlinkAgent`) that runs as LocalSystem, starts automatically with Windows, and restarts itself if it stops unexpectedly.

There are three ways to install it. All of them need administrator rights on the computer.

| Method                                                    | Best for                                     |
| --------------------------------------------------------- | -------------------------------------------- |
| [Signed installer](#use-the-signed-installer)             | A handful of computers, run by hand          |
| [Command line](#use-the-command-line)                     | Scripted rollouts with your management tools |
| [From a support session](#install-from-a-support-session) | A computer you are already connected to      |

Access is available for Windows 10 or later (64-bit). It is not available on a Mac: see [Check supported systems](/install/supported-systems/).

Every method needs a plan that includes **Unattended Access** and a free Access device. Each enrolled computer takes one Access device in your plan: see [Access devices](/configure/plans-and-limits/#access-devices).

## Use the signed installer

[Section titled “Use the signed installer”](#use-the-signed-installer)

The installer is the Access agent with your enrollment key built in. It installs and enrolls with no questions asked.

1. [Create an enrollment key](/install/enrollment-keys/).
2. While the new key is still on screen, select **Download installer**. Blink prepares a signed agent for this key (the button shows **Building…** for a moment) and downloads `blink-agent-<version>.exe`.
3. Copy the file to the computer.
4. Right-click it and choose **Run as administrator**.

The agent enrolls the computer, copies itself to `C:\ProgramData\Blink\blink-agent.exe` and starts the service. The computer appears under **Access** in the console.

Caution

Anyone with the installer can enroll computers into your organization until the key is used up, expires or is revoked. Delete the installer when you are done, and see [Keep keys under control](/install/enrollment-keys/#keep-keys-under-control).

Note

The signed installer needs a server that can reach IZT to build it. On an offline server, use the command line below with the generic agent.

## Use the command line

[Section titled “Use the command line”](#use-the-command-line)

Use this to roll the agent out with a script, your remote management tool, a software deployment tool or a startup script: anything that can run a program as administrator or as SYSTEM on the computer.

Using an RMM tool?

[Deploy the Access agent with your RMM tool](/install/deploy-with-rmm/) has a ready-made script that downloads the agent and enrolls the computer, with steps for NinjaOne, Datto RMM, N-able, ConnectWise, Kaseya, Atera, Syncro, Intune, Group Policy and others.

1. [Create an enrollment key](/install/enrollment-keys/) and copy it.

2. Download the generic agent: select **Agent** next to the command on the new key’s card, or **Access agent** under **Instance** › **License** › **Agent builds** (shown only when your plan includes **Unattended Access**). The file is `blink-agent.exe`.

3. On each computer, from an elevated prompt or your deployment tool, run:

   ```bat
   blink-agent.exe --install --enroll <key>
   ```

The command runs without any window or prompt. The reason for any failure is printed to the console it was started from and written to `C:\ProgramData\Blink\install.log`.

### Exit codes

[Section titled “Exit codes”](#exit-codes)

The install command, `--enroll <key>` on its own, and the signed installer all exit with these codes, so your tool can tell what happened:

| Code | Meaning                                                                                                                                                            |
| ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `0`  | The service is installed (or repaired) and started. For `--enroll`, the computer is enrolled.                                                                      |
| `1`  | Something else failed, for example the prompt was not elevated, the server could not be reached, or the key is invalid or used up. Fix the cause and run it again. |
| `2`  | The command line was wrong, for example an unknown option.                                                                                                         |
| `20` | Your plan’s device limit is reached. The log says **This Blink plan’s device limit is reached. Ask your administrator.**                                           |
| `21` | Your plan does not include Access. The log says **This Blink plan does not include Access. Ask your administrator.**                                               |

Codes `20` and `21` are final. The agent tries once and does not retry, because nothing changes until an administrator frees an Access device or the plan changes. A refused install is rolled back:

* On a computer that was not enrolled yet, nothing is left running: a leftover **IZT Blink Agent** service from an earlier attempt is removed, the device identity made for the refused request is deleted, and the agent’s settings are deleted if this run created them.
* On a computer that is already enrolled, nothing changes. It stays an enrolled device.

The `C:\ProgramData\Blink` folder and its logs stay, so you can read `install.log` afterwards.

There is no option to choose the server: the agent you download from your console already carries your Blink address.

### Run it again safely

[Section titled “Run it again safely”](#run-it-again-safely)

Running the install command on a computer that already has the agent is safe. It does not enroll an already enrolled computer again; it repairs the service if needed and makes sure it is running. That makes it suitable for a policy that runs at every start-up.

Have such a policy stop on exit code `20` or `21`: running the install again does not help until an administrator frees an Access device or the plan changes. See [Exit codes](#exit-codes).

### Other commands

[Section titled “Other commands”](#other-commands)

All of these need an elevated prompt:

| Command                          | What it does                                                                      |
| -------------------------------- | --------------------------------------------------------------------------------- |
| `blink-agent.exe --install`      | Install, repair or start the service on a computer that is already enrolled       |
| `blink-agent.exe --enroll <key>` | Enroll the computer only, without installing the service                          |
| `blink-agent.exe --uninstall`    | Remove the agent: see [Uninstall the Access agent](/install/uninstall-the-agent/) |

### Cloned computers and images

[Section titled “Cloned computers and images”](#cloned-computers-and-images)

The agent’s identity is tied to the computer it was enrolled on. If you clone a disk or a virtual machine with the agent on it, the copy does not use the original’s identity: its agent stays offline until you enroll it. Run the install command with a key on the copy.

For a golden image, the simplest approach is to leave the agent out of the image and install it on each computer after deployment.

## Install from a support session

[Section titled “Install from a support session”](#install-from-a-support-session)

When you are in a Support session with someone at a Windows computer, you can turn that computer into an Access device without sending a file.

1. In the viewer, if the agent is not running as administrator yet, select **Run as admin** and follow the prompts (see [Run as administrator](/use/run-as-administrator/)). The customer approves a Windows prompt at their computer.
2. Select **Install Access** in the viewer toolbar.
3. Choose the **Device group** to put the computer in, or **No group (org-wide access only)** if your role allows that.
4. Select **Install**. If your last sign-in was a while ago, Blink first asks for your authenticator code or passkey.

The button shows **Installing…** and then **Access installed**. The customer is not prompted. Select **Open device in console** to see the new device.

You only see **Install Access** if your role has the **Install Access** permission and your plan includes **Attended Support**, **Install Access from Support** and **Unattended Access**. The computer also needs a free Access device in your plan; at the device limit the install fails and nothing is left installed. If the viewer says **Confirm the computer first**, do that, then try again. Install Access is available in Support sessions only.

## Check the result

[Section titled “Check the result”](#check-the-result)

Open **Access** in the console. The new computer shows with its name, OS and agent version, and the status **online** once the service has connected. From there you can connect to it at any time: see [Manage Access devices](/use/manage-devices/).

If the computer does not appear or stays offline, check `C:\ProgramData\Blink\install.log` and `C:\ProgramData\Blink\service.log`, and see [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).

# Keep agents up to date

> How new Access agent versions reach your computers, how to push one now, and what the update states in the console mean.

You do not reinstall the Access agent to update it. Your server fetches new agent versions from IZT, and the agents update themselves.

## Where new versions come from

[Section titled “Where new versions come from”](#where-new-versions-come-from)

Your server checks with IZT for new agent versions every 10 minutes and keeps the newest build plus the one before it. You can see what it holds under **Instance** › **License** › **Agent builds**:

* The **Agent** table lists each build the server hands out, with its **Version**, the **Previous** version and whether it is **Licensed**.
* The pill shows **Updates on** or **Updates off**. When updates are off, the reason is shown under the heading.
* **Check now** asks IZT straight away instead of waiting for the next check. You need the instance permission **Settings** to open this tab.

On a server that cannot reach IZT, an instance owner brings new versions in with an offline bundle: enter the **Version**, download a **Bundle request**, upload it on the IZT license portal, then select **Import bundle** with the zip it returns.

Support tool

The support tool is never installed, so it never needs updating: every download is the version your server holds at that moment.

## How Access agents update

[Section titled “How Access agents update”](#how-access-agents-update)

When an Access agent connects to your server and its version is older than the server’s current build, the server sends it the update. The agent then:

1. Downloads the new version and checks it is signed by IZT, built for your server, and newer than the version it runs.
2. Checks that the new version starts and finds its settings.
3. Swaps it in and restarts the service.
4. Runs the new version on probation for 24 hours. If the new version keeps crashing or cannot reconnect, the agent rolls back to the previous version on its own.

If a remote terminal is open on the computer, the update waits until the terminals are closed, for at most two hours.

## Push an update now

[Section titled “Push an update now”](#push-an-update-now)

1. Open **Access** in the console. Devices with a newer version available show an **update** pill next to their agent version.
2. Select the device.
3. Select **Update**. The console confirms that the update was pushed.

**Update** is available only while the device is online, is not revoked, and has an update available, and only if your role has the **Edit devices** permission for it.

## Update states

[Section titled “Update states”](#update-states)

The device list and the device details (**Last update**) show how the latest update went:

| State                                                          | What it means                                                                                                                                 |
| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Updating**                                                   | The update was sent; Blink is waiting for the result.                                                                                         |
| **Probation**                                                  | The new version is running. It rolls back on its own if it keeps crashing within 24 hours.                                                    |
| **Update failed**                                              | This attempt failed, for example because the download failed. It is tried again later.                                                        |
| **Update rejected**                                            | The agent refused the build, for example because its signature is not valid. The device will not try that build again.                        |
| **Rolled back**                                                | The new version was removed and the previous one restored. Depending on the reason, it is tried again or not at all.                          |
| **Rollback failed**                                            | The update failed and the previous version could not be restored. Check the device.                                                           |
| **Update skipped**, **Update waiting**, **Update not started** | The device did not start this update, for example because the build failed there before, it is waiting after failed attempts, or it was busy. |

Hover over the state to see the exact reason and when the update is tried again. A successful update shows no state: the new version simply appears as the device’s agent version.

If an update keeps failing, check `C:\ProgramData\Blink\update.log` on the computer and see [Troubleshooting](/troubleshooting/).

# Back up and restore the server

> What to back up on an on-premises Blink server, and how to bring it back on new hardware.

This page is for on-premises servers. In the cloud, IZT looks after the server.

## What to back up

[Section titled “What to back up”](#what-to-back-up)

| What             | Where                                     | How often                                                |
| ---------------- | ----------------------------------------- | -------------------------------------------------------- |
| The database     | Your database server                      | Regularly, with your usual database backup tools         |
| The data folder  | The volume mounted at `/data`             | After first setup, and whenever the database key changes |
| The recovery kit | The two files you downloaded during setup | Once, kept offline                                       |

Every secret in the database is encrypted with the **database key**, which is not stored in the database. A database backup on its own cannot be restored: you also need the key, either from the data folder (`/data/secrets`) or from the **database key backup** in your recovery kit.

Keep the pieces apart

Store the recovery kit offline and away from your database backups, with its passphrase somewhere else again. Someone who has all three has everything.

### If you change the database key

[Section titled “If you change the database key”](#if-you-change-the-database-key)

An instance owner can rotate the database key under **Instance** › **Identity**, in the **Change the identity key** card, with **Rotate database key**. Blink seals every secret again with a new key, and the old database key backup no longer opens anything, so:

1. Enter a passphrase for the new backup (at least 12 characters), confirm it, and select **Rotate and download**.
2. Prove the downloaded backup opens with that passphrase when the console asks.
3. Replace the old database key backup in your recovery kit.
4. Back up the data folder again.

If you have lost the database key backup file, rotating the database key is also how you get a new one.

## Restore on new hardware

[Section titled “Restore on new hardware”](#restore-on-new-hardware)

Use this when the original server is gone and you are bringing Blink back from backups.

1. Restore your database backup on the new database server.

2. Copy the database key backup (`blink-kek-<instance>-<date>.json`) to the new host, somewhere the container can read it. The container runs as an unprivileged user (uid 65532), so the file must be readable by that user.

3. Restore the database key into a new, empty data volume. The server asks for the recovery kit passphrase:

   ```sh
   docker run --rm -i -v blink-data:/data -v /path/to/kit:/kit:ro \
     <blink-server-image> -restore-kek /kit/blink-kek-<instance>-<date>.json
   ```

   Instead of typing it, you can pass the passphrase in the `BLINK_KEK_PASSPHRASE` environment variable. The command writes the key into `/data/secrets`, prints which instance it restored, and exits.

4. Start the server as usual (see [Install Blink on your own server](/install/on-premises-server/)), pointing it at the restored database and the same data volume.

5. Point your DNS name at the new server.

The server refuses to start if the data volume belongs to a different installation than the database, so you cannot mix them up by accident.

Because the server’s identity comes back with the database, your Access agents reconnect on their own once the DNS name points at the new server. You do not need to reinstall them.

Note

Copying the existing `/data` volume to the new host works too. Restoring from the recovery kit is for when that volume is lost.

## If the server’s identity was lost or stolen

[Section titled “If the server’s identity was lost or stolen”](#if-the-servers-identity-was-lost-or-stolen)

If you think someone else has a copy of your server’s identity key (for example, a stolen backup or disk image), the recovery key in your recovery kit lets you replace it without reinstalling your agents. An instance owner does this under **Instance** › **Identity** with **Recover with the recovery file**. The change goes to IZT and then to every Access agent, and you get a new recovery file. If the server itself may be compromised, rebuild it from clean backups first, then recover. If you are unsure, contact [IZT](https://izt.app) before you start.

# Set up certificates

> Give your on-premises Blink server a certificate browsers trust, with Let's Encrypt from the console or your own certificate.

Browsers need a trusted certificate for your Blink address, or your technicians and customers see a security warning. You manage certificates in the console under **Instance** › **Certificates**. You need the instance permission **Certificates**.

Using Blink in the cloud?

Blink Cloud sets your instance’s host names and issues and renews their certificates. The **Certificates** tab shows them, and there is nothing for you to do.

## How Blink picks a certificate

[Section titled “How Blink picks a certificate”](#how-blink-picks-a-certificate)

For each name a browser asks for, Blink serves one certificate, in this order:

1. An **uploaded** certificate that covers the name (an exact name first, then a wildcard).
2. A **Let’s Encrypt** certificate for the name.
3. The **built-in** certificate, for IP addresses and everything else.

The **Served names** card shows which certificate each name gets right now.

### Agents are never affected

[Section titled “Agents are never affected”](#agents-are-never-affected)

Access agents and the support tool do not depend on any of these certificates. They check your server’s own identity key and get its identity certificate, whatever name they connect to. Changing, uploading or deleting a certificate here never breaks agent connections. The **Agent connections** card shows the address agents connect to and the names they used recently.

## Use Let’s Encrypt

[Section titled “Use Let’s Encrypt”](#use-lets-encrypt)

Let’s Encrypt issues free certificates and Blink renews them automatically.

Before you start:

* Every domain must resolve to your server in public DNS.
* Let’s Encrypt must reach your server on **TCP port 443**. If the server listens on another port, forward TCP 443 to it.

1. Open **Instance** › **Certificates** and go to the **Let’s Encrypt** card.
2. Tick **Use Let’s Encrypt**.
3. Under **Domains**, enter one domain per line, for example `blink.example.com`. Wildcards and IP addresses are not allowed, and you can add up to 20 domains.
4. Optionally enter an **Email**. It is used only when the account is first created.
5. Under **Directory**, choose **Staging** for a first test.
6. Select **Save**. Each domain appears in the table with its **State**.
7. When the staging certificate shows **Valid**, switch the **Directory** to **Production** and select **Save** again.

Use Staging first

Each domain gets at most 4 attempts per hour, because Let’s Encrypt allows 5 failed validations per hour. Test with **Staging** until everything works, then switch to **Production**.

If a domain shows **Retrying**, the table says when the next try is and shows the last error. **Issue now** requests a certificate straight away when one is needed and the hourly limit allows it.

The states you can see are **Pending**, **Issuing**, **Valid**, **Retrying**, **Renewal overdue**, **Expiring** and **Expired**. The **Attempts** column shows how many of the 4 hourly attempts a domain has used.

## Upload your own certificate

[Section titled “Upload your own certificate”](#upload-your-own-certificate)

Use this for a certificate from a commercial provider or your own private certificate authority. An uploaded certificate wins over Let’s Encrypt for the names it covers.

You need:

* The **certificate chain** in PEM format: the server certificate first, then its intermediates (at most 10 certificates).
* The **private key**, unencrypted: an RSA key of 2048 bits or more, or an ECDSA P-256 or P-384 key.
* A certificate that lists the DNS names in its subject alternative names, is valid for TLS servers, and is valid now (not expired and not dated in the future). Certificates that require OCSP stapling are not supported.

1. Open **Instance** › **Certificates** and select **Upload certificate**.
2. Paste the chain under **Certificate chain**, or use **Choose file**.
3. Paste the key under **Private key**, or use **Choose file**.
4. Select **Upload**. If Blink has notes about the certificate, it shows them and the button becomes **Upload anyway**.

The certificate is served only for the DNS names it lists. IP addresses keep the built-in certificate.

Note

The private key is stored in the server’s database, so database backups include it. It is never shown again.

A certificate from a private CA is marked **Private CA**: public browsers do not trust it unless your computers trust that CA. Uploaded certificates show the states **Active**, **Expiring**, **Expired**, **Not yet valid**, **Not used** (another certificate is served instead) and **Invalid**. Expiry dates are highlighted as a warning under 30 days and as urgent under 7.

To remove an uploaded certificate, select the delete icon in its row. You can keep up to 50 uploaded certificates.

## The built-in certificate

[Section titled “The built-in certificate”](#the-built-in-certificate)

Every server creates its own certificate at first start. It is served to IP addresses and to every name no other certificate covers, and it never changes. Browsers do not trust it, so expect a warning when you use it.

The **Built-in certificate** card shows its names and its SHA-256 fingerprint, so you can check you are talking to your own server before you accept the warning.

Locked out after a certificate change?

The **Built-in certificate** card lists addresses that always use the built-in certificate. Note them down: if a certificate change ever locks you out of the console, open one of them and fix the certificate from there.

# Deploy the Access agent with your RMM tool

> Ready-to-use PowerShell and Command Prompt scripts that install and enroll the Access agent, with steps for the common RMM and deployment tools, Intune, Configuration Manager and Group Policy.

If you already manage your customers’ computers with a remote monitoring and management (RMM) tool, you can roll the Access agent out to all of them with one script. The script downloads the agent from your Blink address, checks its signature, installs it and enrolls the computer with your key. It runs silently, needs no one at the keyboard, and is safe to run again on a computer that already has the agent.

This page gives you the scripts, then the steps for each tool. For what the install command itself does, see [Install the Access agent on Windows](/install/access-agent-windows/#use-the-command-line). Moving from another remote access tool? See [Switch from your old remote access tool](#switch-from-your-old-remote-access-tool).

## Before you start

[Section titled “Before you start”](#before-you-start)

* **An enrollment key for each customer.** A key enrolls computers into one organization and, optionally, one device group. Create one key per customer (or per site), with a **Max uses** that matches the rollout and an expiry you are comfortable with. See [Create an enrollment key](/install/enrollment-keys/).
* **Your Blink address**, for example `https://yourname.onblink.cloud`.
* **Free Access devices in your plan.** Each enrolled computer takes one. See [Access devices](/configure/plans-and-limits/#access-devices).
* **Windows 10 or later, 64-bit (x64).** See [Check supported systems](/install/supported-systems/).
* **A direct connection to your Blink address.** The agent does not use a web proxy and refuses HTTPS inspection. Exclude your Blink address from both before the rollout. Otherwise the script’s download can succeed through the proxy while the installed agent cannot connect, and the computer stays **offline**. See [Network](/install/supported-systems/#network).

The script runs as the system account or as an administrator, which is how these tools run scripts by default. It works in 32-bit and 64-bit PowerShell.

### Where the agent comes from

[Section titled “Where the agent comes from”](#where-the-agent-comes-from)

Every Blink server hands out the generic Access agent at:

```plaintext
https://<your Blink address>/api/agent/binary
```

This is the same file as **Access agent** under **Instance** › **License** › **Agent builds**. It is signed by **IZT Apps, Inc.**, carries your Blink address, and holds no enrollment key, so the URL needs no sign-in and is safe to put in a script. The key is passed on the command line instead, which keeps it out of the file and lets you keep it in your tool’s protected fields.

Self-signed certificate on premises

If your Blink server still uses its built-in certificate (browsers show a certificate warning), Windows refuses the download. [Set up a trusted certificate](/install/certificates/), or upload `blink-agent.exe` to your tool and use the [variant that skips the download](#if-your-tool-ships-the-file).

### Keep the key secret

[Section titled “Keep the key secret”](#keep-the-key-secret)

Anyone with an enrollment key can enroll computers into that organization until the key is used up, expires or is revoked. Put the key in your tool’s secure or password-type field where it has one, not in the script text, and never in a script library shared outside your company. Many tools keep a copy of a script’s command line or text in their logs and job history, so assume the key can be read there too. Give each key a **Max uses** close to the number of computers and a short expiry, and revoke it when the rollout is done. See [Keep keys under control](/install/enrollment-keys/#keep-keys-under-control).

### Tell your security tools first

[Section titled “Tell your security tools first”](#tell-your-security-tools-first)

Installing a new remote access tool on many computers at once is exactly what attackers do, so security tools watch for it:

* **Tell your SOC or MDR provider** before a mass rollout, so they expect the new service and do not isolate computers.
* **Application control** (ThreatLocker, AppLocker, App Control for Business and similar): allow Blink by its publisher, **IZT Apps, Inc.**, not by file hash or certificate thumbprint. The agent replaces itself with every update, and its signing certificate is renewed every few days, so hashes and thumbprints keep changing. The script runs the downloaded file from the system’s temp folder (`C:\Windows\Temp` when it runs as the system account). If your policy blocks programs there, allow it or use the [file directly](#if-your-tool-ships-the-file).
* **Microsoft Defender**: the attack surface reduction rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** can block a newly released agent version for its first days. If you use that rule, add an exclusion for `C:\ProgramData\Blink\blink-agent.exe` and for the script’s download.

### How tools can tell the agent is installed

[Section titled “How tools can tell the agent is installed”](#how-tools-can-tell-the-agent-is-installed)

The Access agent does not appear in **Apps** or **Programs and Features**, so a tool that checks for installed software by its display name never finds it and tries to install it again every time. Detect it by either of these instead:

* The Windows service `BlinkAgent` (registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BlinkAgent`).
* The file `C:\ProgramData\Blink\blink-agent.exe`. Its product version is the agent version.

## The PowerShell script

[Section titled “The PowerShell script”](#the-powershell-script)

Use this with any tool that runs PowerShell. Tools hand values to scripts in different ways, so the script takes the Blink address and the enrollment key from the first of these it finds:

1. The variables `$BlinkAddress` and `$EnrollKey`, if your tool sets them or you add lines that set them (the steps for your tool say which lines). A placeholder your tool left unfilled, such as `{{...}}`, `{[...]}` or `@...@`, counts as not set.
2. Two command-line arguments: the address, then the key.
3. The environment variables `BLINK_ADDRESS` and `BLINK_ENROLL_KEY`.

```powershell
# Install and enroll the IZT Blink Access agent.
# Exit codes: 0 installed, 1 failed, 2 address or key missing,
# 20 device limit reached, 21 plan does not include Access.


# >>> Lines for your tool go here (see the steps for your tool). <<<


# A placeholder your tool left unfilled counts as not set.
$placeholder = '^\s*(\{\{.*\}\}|\{\[.*\]\}|\x40.*\x40)\s*$'
if ("$BlinkAddress" -match $placeholder) { $BlinkAddress = $null }
if ("$EnrollKey" -match $placeholder)    { $EnrollKey    = $null }


if (-not $BlinkAddress -and $args.Count -ge 2 -and "$($args[0])" -notlike '-*') {
    $BlinkAddress = "$($args[0])"
    $EnrollKey    = "$($args[1])"
}
if (-not $BlinkAddress) { $BlinkAddress = $env:BLINK_ADDRESS }
if (-not $EnrollKey)    { $EnrollKey    = $env:BLINK_ENROLL_KEY }
$BlinkAddress = "$BlinkAddress".Trim().TrimEnd('/')
$EnrollKey    = "$EnrollKey".Trim()


$ErrorActionPreference = 'Stop'
$ProgressPreference    = 'SilentlyContinue'


if (-not $BlinkAddress -or -not $EnrollKey) {
    Write-Output 'Blink: set the Blink address and the enrollment key.'
    exit 2
}
if ($BlinkAddress -notmatch '^https?://') { $BlinkAddress = 'https://' + $BlinkAddress }


# Windows PowerShell 5.1 may not offer TLS 1.2 by default: add it.
# (No effect on PowerShell 7; not allowed in Constrained Language Mode.)
if ($ExecutionContext.SessionState.LanguageMode -eq 'FullLanguage') {
    $tls = [Net.ServicePointManager]::SecurityProtocol
    if ([int]$tls -ne 0) {
        [Net.ServicePointManager]::SecurityProtocol = $tls -bor [Net.SecurityProtocolType]::Tls12
    }
}


# Already installed and running: nothing to do.
$service = Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq 'Running') {
    Write-Output 'Blink: the Access agent is already installed and running.'
    exit 0
}


# Download into a new folder of its own, which other users cannot find.
$temp = if ($env:TEMP) { $env:TEMP } else { Join-Path $env:SystemRoot 'Temp' }
$dir  = Join-Path $temp ('blink-' + [guid]::NewGuid().ToString('N'))
$exe  = Join-Path $dir 'blink-agent.exe'
$url  = $BlinkAddress + '/api/agent/binary'


try {
    $null = New-Item -ItemType Directory -Path $dir -Force
    Invoke-WebRequest -Uri $url -OutFile $exe -UseBasicParsing
} catch {
    Write-Output "Blink: could not download the agent from $url : $($_.Exception.Message)"
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
    exit 1
}


# Run the file only if it is signed by IZT Apps, Inc.
$sig = Get-AuthenticodeSignature -FilePath $exe
if ($sig.Status -ne 'Valid' -or "$($sig.SignerCertificate.Subject)" -notmatch '(^|,\s*)CN="?IZT Apps, Inc\."?(,|$)') {
    Write-Output 'Blink: the downloaded file is not signed by IZT Apps, Inc., so it was not run.'
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
    exit 1
}


$code = 1
try {
    $p = Start-Process -FilePath $exe -ArgumentList '--install', '--enroll', $EnrollKey -Wait -PassThru -WindowStyle Hidden
    if ($null -eq $p.ExitCode) { throw 'its exit code could not be read.' }
    $code = $p.ExitCode
} catch {
    Write-Output "Blink: could not run the agent installer: $($_.Exception.Message)"
} finally {
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
}


switch ($code) {
    0       { Write-Output 'Blink: the Access agent is installed and enrolled.' }
    20      { Write-Output "Blink: this Blink plan's device limit is reached." }
    21      { Write-Output 'Blink: this Blink plan does not include Access.' }
    default {
        Write-Output "Blink: the install failed with exit code $code."
        $log = Join-Path $env:ProgramData 'Blink\install.log'
        Get-Content -LiteralPath $log -Tail 20 -ErrorAction SilentlyContinue
    }
}
exit $code
```

The script passes the agent’s own exit code back to your tool, so a failed install shows as failed. The codes are the ones in [Exit codes](/install/access-agent-windows/#exit-codes); the script adds `2` when the address or key is missing. On a failure it prints the end of `C:\ProgramData\Blink\install.log` into the job output, so you can usually see the reason without connecting to the computer.

Before it runs the download, the script checks that the file carries a valid signature from **IZT Apps, Inc.** and stops with exit code `1` if it does not.

Running the saved file yourself

If you start the script file from a command line, use `powershell.exe -File install-blink.ps1 <address> <key>`. With `-Command` instead of `-File`, PowerShell turns every exit code other than `0` into `1`, so your tool cannot tell `20` and `21` apart from other failures.

## The Command Prompt script

[Section titled “The Command Prompt script”](#the-command-prompt-script)

Use this where your tool runs batch files, or for a Group Policy startup script. It needs `curl.exe`, which is part of Windows 10 and 11; keep Windows up to date so it is a current version. It retries the download for about two minutes, because at start-up the network may not be ready yet.

```bat
@echo off
rem Install and enroll the IZT Blink Access agent.
rem Exit codes: 0 installed, 1 failed, 2 address or key missing,
rem 20 device limit reached, 21 plan does not include Access.
setlocal
if not defined BLINK_ADDRESS set "BLINK_ADDRESS=https://yourname.onblink.cloud"
if not defined BLINK_ENROLL_KEY set "BLINK_ENROLL_KEY=PASTE-YOUR-KEY-HERE"


if "%BLINK_ENROLL_KEY%"=="PASTE-YOUR-KEY-HERE" (
    echo Blink: set the Blink address and the enrollment key.
    exit /b 2
)
if "%BLINK_ADDRESS:~-1%"=="/" set "BLINK_ADDRESS=%BLINK_ADDRESS:~0,-1%"


rem Already installed and running: nothing to do.
sc query BlinkAgent | find "RUNNING" >nul && (echo Blink: the Access agent is already installed and running.& exit /b 0)


rem Download into a new folder that only SYSTEM and administrators can write to.
set "CODE=1"
set "DIR=%TEMP%\blink-%RANDOM%%RANDOM%"
mkdir "%DIR%" || (echo Blink: could not create a download folder.& exit /b 1)
icacls "%DIR%" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F >nul || goto :done
set "EXE=%DIR%\blink-agent.exe"
if exist "%EXE%" goto :done


rem Try for about two minutes: at start-up the network may not be ready yet.
set "TRIES=0"
:download
set /a TRIES+=1
"%SystemRoot%\System32\curl.exe" --fail --silent --show-error --location --ssl-revoke-best-effort --connect-timeout 30 --max-time 300 --output "%EXE%" "%BLINK_ADDRESS%/api/agent/binary"
if not errorlevel 1 goto :install
if %TRIES% geq 6 (
    echo Blink: could not download the agent from %BLINK_ADDRESS%.
    goto :done
)
ping -n 21 127.0.0.1 >nul
goto :download


:install
"%EXE%" --install --enroll "%BLINK_ENROLL_KEY%"
set "CODE=%ERRORLEVEL%"
if "%CODE%"=="0"  echo Blink: the Access agent is installed and enrolled.
if "%CODE%"=="20" echo Blink: this Blink plan's device limit is reached.
if "%CODE%"=="21" echo Blink: this Blink plan does not include Access.
if not "%CODE%"=="0" if not "%CODE%"=="20" if not "%CODE%"=="21" echo Blink: the install failed with exit code %CODE%. See C:\ProgramData\Blink\install.log.


:done
rd /s /q "%DIR%" >nul 2>&1
exit /b %CODE%
```

Replace the two `set` values, or have your tool set `BLINK_ADDRESS` and `BLINK_ENROLL_KEY` before the script runs. Unlike the PowerShell script, it does not check the file’s signature before running it.

## If your tool ships the file

[Section titled “If your tool ships the file”](#if-your-tool-ships-the-file)

Some tools attach a file to a script or a software package and copy it to the computer before running it. That is also the way to go when computers cannot reach your Blink address over HTTPS during the rollout, or your server uses its built-in certificate.

1. Download **Access agent** from **Instance** › **License** › **Agent builds**, or select **Agent** on the card Blink shows right after you create an enrollment key. The file is `blink-agent.exe`. To check it, right-click it, select **Properties** › **Digital Signatures**, and make sure the signer is **IZT Apps, Inc.**

2. Add it to your tool’s package or script attachments.

3. Run it, from the folder the tool puts it in, with:

   ```bat
   blink-agent.exe --install --enroll <key>
   ```

A file you upload stays at the version you uploaded. That is fine for updates: the agent [updates itself](/install/agent-updates/) after it connects. Replace the uploaded file now and then, so new computers start on a recent version, and always download a fresh copy after your Blink address changes.

## Steps for each tool

[Section titled “Steps for each tool”](#steps-for-each-tool)

The menus below are the ones these tools show at the time of writing; they change from time to time, so check your tool’s own help if yours look different. The idea is always the same: add the PowerShell script, give it the address and key, run it as the system account on the computers you choose, and allow it a few minutes to finish.

Most tools let you store a value once per customer (a client, site or organization field). That is the best place for the enrollment key: one key per customer, and the same script for everyone.

Using **Kaseya 365**? Its endpoint management is Datto RMM or Kaseya VSA: follow the steps for the one you use.

### NinjaOne

[Section titled “NinjaOne”](#ninjaone)

1. Create a custom field for the key. Go to **Administration** › **Organizations** › **Organization Custom Fields**, select **+ Add custom field** › **Field**, and choose the **Secure** type. Give it a label such as `Blink Enroll Key` and note the **Name** NinjaOne fills in from it (for example `blinkEnrollKey`).

   * Make sure the field’s **Inheritance** includes devices. Scripts run on the device and cannot read the field otherwise.
   * On the **Permissions** tab, set **Automations** to **Read Only**. Scripts cannot read a field without it.

2. Fill in the field on each organization with that organization’s key. Leave it empty on locations and devices: a value there takes priority over the organization’s.

3. Go to **Administration** › **Library** › **Automation** › **Add automation** › **New Script**. Set **Language** to **PowerShell**, the operating system to **Windows**, **Architecture** to **All** and **Run As** to **System**.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add these lines, with the **Name** of your field:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = Ninja-Property-Get blinkEnrollKey
   ```

   `Get-NinjaProperty -Name blinkEnrollKey -Type Secure` is the newer equivalent and works too.

5. Run it on the devices: from a device’s action menu select **Run Automation**, or select several devices under **Devices** and click **Run**. To cover new devices too, go to **Administration** › **Policies**, open the policy, select **Scheduled Automations** › **+Add automation**, add the script and schedule it with **Run once immediately**. That runs it on online devices when you save the policy, on offline devices when they come back online, and on devices added to the policy later.

NinjaOne counts any exit code other than `0` as a failure. Check the result in the device’s **Activities** tab.

Test with Run Automation, not the terminal

NinjaOne hands secure fields only to a running automation. From the web terminal or a local terminal the key comes back empty, and the script stops with exit code `2`.

### Datto RMM

[Section titled “Datto RMM”](#datto-rmm)

1. Go to **Setup** › **Global Settings**. Under **Variables**, click **Add Variable** for each of these, then click **Save**:

   * **Name** `BLINK_ADDRESS`, **Value** your Blink address.
   * **Name** `BLINK_ENROLL_KEY`, **Value** a placeholder that is not a key, for example `none`.

2. For each customer, go to **Sites** › **All Sites** and click the site. Click **Settings** in the left menu and scroll to **Variables**. Click **Add Variable**, enter **Name** `BLINK_ENROLL_KEY` and that customer’s key as the **Value**, tick **Masked** and click **Save**. Type the name exactly as above, including the capitals: a site variable only replaces the global one when the names match exactly. You cannot change **Masked** after saving.

3. Go to **Automation** › **Components** › **Create Component**. Choose the category **Scripts** and the script type **PowerShell**, and paste the PowerShell script unchanged. Datto RMM hands variables to PowerShell as environment variables, which the script reads. Set **Timeout this script if not completed within (seconds)** to at least `300`.

4. Under **Variables**, in **Global & Site**, select the global `BLINK_ADDRESS` and `BLINK_ENROLL_KEY`. Datto RMM sends a component only the variables you select there, and each site’s own `BLINK_ENROLL_KEY` replaces the global placeholder when the job runs. If your editor has no **Global & Site** section yet, skip this step: the component then receives all global and site variables. Do not add either name under **Component** variables: a component variable always wins, even when it is empty. Click **Create Component**.

5. Run the component as a **Quick Job** on the customer’s devices (**Devices** › **All**, tick the devices, **Quick Job**). To catch new computers too, go to **Automation** › **Jobs** › **Create Job**, add the component, add the customer’s sites as targets, choose **Initial Audit** under **Schedule**, and keep **Run as system account**.

Quick jobs always run as the local system account. A job shows **Success** when the script exits with `0`, and the script’s messages appear under **StdOut/StdErr** in the job results.

Caution

Never put a real key in the global `BLINK_ENROLL_KEY`. Every site without its own value receives the global one. With the placeholder, the job fails on those sites instead of enrolling their computers anywhere.

**Masked** hides the key in the console, but a computer with the agent’s extended logging turned on writes masked values to its log file in clear text. Make sure extended logging is off on the computers you target.

### N-able N-central

[Section titled “N-able N-central”](#n-able-n-central)

1. Save the PowerShell script as `install-blink.ps1`. N-central does not accept spaces in script file names.

2. Go to **Configuration** › **Scheduled Tasks** › **Script/Software Repository** and select **Add** › **Scripting**. Enter a **Name**, select **Browse** next to **File Name** and choose `install-blink.ps1`. Leave **Command Line Parameters** empty here, because every task that uses this script shares that value. Select **OK**.

3. Go to **Configuration** › **Scheduled Tasks** › **Add/Delete** and select **Add** › **Scripting**. Enter a **Task Name** that includes the customer’s name, select **Use LocalSystem Credentials**, and choose the script you added to the repository. In **Command Line Parameters**, enter the address and that customer’s key, separated by a space:

   ```plaintext
   https://yourname.onblink.cloud <key>
   ```

4. On the **Task Handler** tab, have the agent run the script. On the **Targets** tab, pick that customer’s devices. On the **Schedule** tab, choose **Now**, **Once** or **Recurring** and set an **Execution Timeout** of at least 5 minutes. Select **Save**.

5. Repeat steps 3 and 4 for each customer, so each task uses its own key.

N-central does not check the script or its parameters before it runs the task, so try the task on one device first. If you target devices with a filter, N-central uses a snapshot of that filter, so devices added later are not included. To cover them, N-able recommends a scheduled task profile.

Caution

**Command Line Parameters** is not a masked field. Anyone who can open the task can read the key, so use short-lived keys with a low **Max uses** and revoke them when the rollout is done.

Keep the key in a password property

N-central can hold a masked value per customer in a custom property (**Administration** › **Custom Properties** › **Add** › **By Customers** › **Password Type**). Only Automation Manager policies can use it. Build a policy with a **Run PowerShell 5.1 Script** object, paste the PowerShell script, and add input parameters named `BlinkAddress` and `EnrollKey`. The script receives them as `$BlinkAddress` and `$EnrollKey`, so it needs no extra lines. When you add the task with **Configuration** › **Scheduled Tasks** › **Add/Delete** › **Add** › **Automation Policy**, set the `EnrollKey` input parameter to the custom property. N-able notes that this object handles password inputs as ordinary text once the script runs.

If a task fails, the N-central agent writes the error code, for example `AG_ERR_REMO_043` with the return code, to `RemoteExecutionModule.log` or `agent.log` in its log folder on that computer. The script also prints the end of `C:\ProgramData\Blink\install.log` to the task output.

### N-able N-sight RMM

[Section titled “N-able N-sight RMM”](#n-able-n-sight-rmm)

1. Save the PowerShell script, unchanged, as `install-blink.ps1`.

2. In the **All Devices** view, go to **Settings** › **Script Manager** and select **New**. In **Add User Defined Scripts**, enter a **Name**, set **Type** to **Automated Task**, choose Windows as the **OS**, and set **Default Timeout** (in seconds, at most `3600`) high enough for the download and install, for example `600`. Browse to `install-blink.ps1` and select **Save**.

3. In the client list, right-click the customer’s client or site and select **Task** › **Add**. Select the script and select **Next**. When asked, choose servers, workstations or both.

4. Enter a task name. In **Command Line**, enter the address and the key, separated by a space:

   ```plaintext
   https://yourname.onblink.cloud <key>
   ```

5. In **Select Frequency Method**, choose **Manual** to run it now, or a schedule. Select **Next**, select the devices that should get the agent, and select **Add Task**.

Use a separate task for each customer, so each one uses its own key. The task runs with the account of the **Advanced Monitoring Agent** service, which is the local system account unless someone changed it. On computers that already have the agent, the script ends straight away, so running the task again is safe.

N-sight adds two arguments of its own (`-logfile` and a file name) after yours. The script reads only the first two, so leave it as it is and do not add a `param()` block.

The key is stored in plain text

N-sight has no protected field for task parameters, so the key is stored in plain text on the task. Give the key a short expiry and revoke it when the rollout is done.

N-sight marks any exit code other than `0` as failed. It reserves codes `1` to `999` for its own scripts, so for the script’s codes `1`, `2`, `20` and `21` the task shows as failed but the script’s message may not show correctly. N-sight may also shorten the output, and results appear only after the device next checks in. Look at the exit code and [Check the rollout](#check-the-rollout).

### ConnectWise RMM

[Section titled “ConnectWise RMM”](#connectwise-rmm)

1. Create a custom field for the key. Go to **Settings** › **Custom Fields** › **Add Field +**. Name it `Blink_Enroll_Key` (letters, numbers and underscores only), set **Level** to **Company** (or **Site** if you use one key per site) and **Type** to **Text Box**, leave the default value empty, and mark the field as editable. Then, for each customer, go to **Clients** › **Companies**, select the company, open its **Custom Fields** tab and enter that customer’s key.

2. Go to **Automation** › **Tasks** › **Add** › **Script Editor** and name the task. Every row you add needs an **Operating System**: choose **Windows**.

3. Click **Add Row** and choose **Set Pre-defined Variable**. Enter `Enroll_Key` as the variable name, choose **Custom Field** and select `Blink_Enroll_Key`.

4. Click **Add Row** and choose **PowerShell Script**. Set **Run As** to **System**, set **Expected time of script execution in seconds** to `600`, and tick **Continue on Failure** so the rows after it still run. Paste the PowerShell script, and in place of the “Lines for your tool” comment add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '@Enroll_Key@'
   ```

   ConnectWise RMM replaces `@Enroll_Key@` with the key from the computer’s company before the script runs.

5. Click **Add Row**, choose **Script Log** and enter `%output%` as the message, so the script’s output shows in the task results.

6. Click **Add Logic**. Build the condition on **Output**, **Does not contain**, `Blink: the Access agent is`, and under it add a **Script Exit** row with the message `Blink: the install failed. See the output above.` Both of the script’s success messages contain that text and none of its failure messages do, so a refused install shows as a failed task.

7. Click **Save**. Select the task and click **Schedule**. Choose **Run Now**, a schedule, or **Next Agent Check-In** for computers that are offline (a Run Now task on an offline computer fails by timeout). Click **Select Targets**, choose the companies, sites, device groups or devices, and click **Run**.

Caution

ConnectWise RMM has no masked field type. Anyone whose role can view custom field values can read the key. By default that includes **Manager**, **Technician**, **Office Staff** and **Client Site Manager**. Revoke the key when the rollout is done.

Note

To type the key when you schedule the task instead, skip steps 1 and 3. Click **Add Parameter** in the Script Editor, name it `Enroll_Key` with the type **Text String**, and enter the key under **Schedule**, with a separate schedule for each customer. Parameter values show on the task’s **Scheduling** tab.

### ConnectWise Automate

[Section titled “ConnectWise Automate”](#connectwise-automate)

1. Create a client-level extra data field (EDF) for the key, with **Field Type** **Text**, for example named `Blink Enroll Key`, and fill in each client’s key.

2. Under **Automation**, pick a script folder and add a new script with **Target** set to **Computer**.

3. Add an **ExtraData Get Value** step. As **Extra Field**, pick your key field (the entry for the client level). Enter `%clientid%` as **ID** and `BlinkEnrollKey` as **Variable**, without `@` signs.

4. Add an **Execute Script** step from **Command Execution**. Set **Script Type** to **PowerShell Bypass**, so the computer’s execution policy does not block it. Set **Script Credentials** to **Local Agent**, so it runs as the system account. Enter `BlinkResult` as **Variable**.

5. Paste the PowerShell script into the script box. In place of the “Lines for your tool” comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '@BlinkEnrollKey@'
   ```

   Automate replaces `@BlinkEnrollKey@` with the client’s key before the script runs.

6. Add a **Script Log Message** step with `@BlinkResult@`, so the script’s `Blink:` lines show in the script log.

7. Save the script. Run it on one computer and check the script log, then run it on the client’s computers or groups.

Caution

Automate replaces `@name@` and `%name%` tokens anywhere in the script text. The Blink PowerShell script has none of its own, so do not add any when you edit it. Use the PowerShell script here, not the Command Prompt one.

Tip

If the install fails, check that the client’s field is filled in, that the **Extra Field** and **ID** in step 3 match a client-level field, and that the variable name is spelled the same in steps 3 and 5. If you mark the key field as masked, test on one computer first to make sure the key still reaches the script.

To ship the file instead, put `blink-agent.exe` in the `LTShare\Transfer` folder on your Automate server. Add a **File Download** step that saves it to the computer, for example as `C:\Windows\Temp\blink-agent.exe`. Then add a **Process Execute** step with that path as **File**, `--install --enroll @BlinkEnrollKey@` as **Arguments**, and **Wait for Process**.

### Kaseya VSA 10

[Section titled “Kaseya VSA 10”](#kaseya-vsa-10)

Kaseya VSA 10 was formerly called VSA X. You keep each customer’s key in an organization custom field and run the [PowerShell script](#the-powershell-script) from the Automation Hub.

1. Create the custom field. Go to **Automation** › **Custom Fields** and click **Create Custom Field**. Enter a **Display Name** such as `BlinkEnrollKey`, set **Type** to **Text**, select only **Organization** under **Contexts**, leave **Expires** off, and click **Create**.

2. Fill in each customer’s key. Go to **Configuration** › **Organizations** and select the organization. On the **Custom Fields** tab, click **Edit**, then **Assign Custom Field**. Pick the field, choose **Enter manually**, paste that customer’s key, click **Add**, then **Save**.

3. Go to **Automation** › **Automation Hub**, select a folder under **User Defined**, open the **Scripts** tab and click **Create Script**. Give it a **Name**.

4. Under **Inputs**, click **+ New** and add two variables, clicking **Save Variable** after each. The names must match exactly, because the script reads them by name:

   * **Name** `BlinkAddress`, **Variable Type** **Text**, **Default Value** your Blink address.
   * **Name** `EnrollKey`, with **Use custom field value** turned on and the field from step 1 selected as the **Custom Field**.

5. In the **Windows** section, turn on **Enable** and keep the **Script type** as **PowerShell**. Paste the PowerShell script into the editor below the input lines VSA 10 adds at the top, then click **Create** (**Save** when you edit an existing script). VSA 10 hands each input to the script as a PowerShell variable with the same name, so `$BlinkAddress` and `$EnrollKey` are already set and you need no lines in place of the “Lines for your tool” comment.

6. Go to **Devices** › **Device Management**, select the customer’s computers, and choose **Actions** › **Run Script**. Pick the script, click **Next**, choose **Run now** and click **Run**. If VSA 10 asks you to confirm, tick the box and click **Confirm**. Scripts started this way run as System. Follow progress with **Bulk Action History** at the top of the page. To run the script on a schedule, add it to a task on the **Tasks** tab of the Automation Hub.

If the job output shows `Blink: set the Blink address and the enrollment key.`, an input did not arrive. Check that the input names are exactly `BlinkAddress` and `EnrollKey`, and that the organization has a value for the custom field.

The key is not hidden

VSA 10 custom fields have no secure or password type, so the key is stored as plain text and other VSA 10 users can see it. Revoke the key when the rollout is done.

Shipping the file instead

To push `blink-agent.exe` from VSA 10 rather than download it, upload it on the **Managed Files** tab of a **User Defined** folder in the Automation Hub with **Upload File**. Then build a workflow with a **Write File** action, which copies the file to `C:\ProgramData\Kaseya\VSAX\Working`. Add an **Execute PowerShell Command** action that runs `& "C:\ProgramData\Kaseya\VSAX\Working\blink-agent.exe" --install --enroll <key>` as System, not as the current user. Finish with a **Delete File** action. The key in that command is plain text too. Each workflow action stops after 30 minutes.

Tip

Don’t run the script from a Client Portal troubleshooter. Troubleshooters run scripts as the logged-in user, not as System.

### Kaseya VSA 9

[Section titled “Kaseya VSA 9”](#kaseya-vsa-9)

These steps are for the classic VSA (9.x) **Agent Procedures**. Run the PowerShell script as a file. Do not paste it into a step: VSA reads `<`, `>` and `#` in a step’s fields as variable markers, and the script contains all three.

1. Save the PowerShell script unchanged as `install-blink.ps1`. You do not need to add any lines, because the procedure passes the address and key as arguments. Go to **Agent Procedures** › **Manage Procedures** › **Schedule / Create**, click **Manage Files**, choose **Shared files** and upload it. If VSA refuses the file, add the `.ps1` extension under **Server Management** › **Default Settings**.

2. Click **Manage Variables**. Select **\<New Variable>**, name it `BlinkEnrollKey` (names are case sensitive) and choose **Public** if other VSA users will run the procedure. Only master role users can create public variables. Enter one customer’s key in **Set Variable Value**, tick that customer’s group IDs and click **Apply**. Repeat for each customer.

3. Select a folder, click **New Procedure** and add these steps in order:

   * **getVariable()**: choose **Secure Agent Working Directory Path** and store it in a variable named `blinkdir`.
   * **writeFile()**: write the uploaded `install-blink.ps1` to `#blinkdir#\install-blink.ps1`.
   * **executePowerShell64BitSystem**: use `#blinkdir#\install-blink.ps1` as the file, `https://yourname.onblink.cloud <BlinkEnrollKey>` as the arguments, and turn on the option that sends the output to a variable.
   * **writeProcedureLogEntry()**: enter `#global:psresult#`, so the script’s `Blink:` lines appear in the machine’s **Agent Procedure Log**.

4. Select the procedure. On the **Schedule** tab, tick the machines and click **Run Now** or **Schedule Procedure**. Run it only on machines whose group has a `BlinkEnrollKey` value.

The key is not hidden

VSA 9 has no secret variable type. Users who open **Manage Variables** see the key in plain text for the groups they administer. Revoke the key when the rollout is done.

Note

VSA’s help does not say whether the script’s exit code marks the step as failed, so check the `Blink:` line in the log, not only the procedure status. When VSA runs PowerShell as System, it sets the computer’s LocalMachine execution policy to **Unrestricted**. To change it back, add a final step that runs `Set-ExecutionPolicy` with your usual value.

To [ship the file](#if-your-tool-ships-the-file) instead, upload `blink-agent.exe` with **Manage Files** and use **writeFile()** to copy it to `#blinkdir#\blink-agent.exe`. Then use **executeFile()** on that path with the arguments `--install --enroll <BlinkEnrollKey>`, run it as the system account, and have the procedure wait until it completes.

### Atera

[Section titled “Atera”](#atera)

1. Go to **Admin** › **Monitoring and automation** › **Scripts** and click **+ Create script**. Enter a **Script Name** and **Script description**, and set **File type** to **.ps1**.

2. Click **More script properties**. Leave **Run as** on **System** and **Arguments** empty, and don’t set **Max script run time (minutes)** below 5.

3. Paste the PowerShell script into the script editor. In place of the “Lines for your tool” comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '{[EnrollKey]}'
   ```

   `{[EnrollKey]}` is an Atera script variable: Atera puts the value you give it into the script text before it runs. Click **Create**.

4. Go to **Customers**, open the customer and go to the **Devices** tab. Select the devices and click **Run script**. Choose how long to queue the script for devices that are offline, pick the script, and paste that customer’s key when Atera asks for the `EnrollKey` value.

To run it on a schedule instead, add the script to an automation profile under **Admin** › **Monitoring and automation** › **Patch management and IT automation**, set the `EnrollKey` value in the profile, and assign the profile to the customer. The value is saved in the profile, so use a separate profile for each customer.

To check a manual run, go to **Reports** › **General** › **Recent Processes**, expand the customer and click the info icon to see the script output with the Blink messages. Results from automation profiles are not in that report; see **Reports** › **Classic Reports** › **Patch & Automation Feedback**.

Caution

Atera has no secret or masked script variable, so the key is stored and shown as plain text. Revoke it when the rollout is done.

You can also upload `blink-agent.exe` with **Upload script** on the same page and put `--install --enroll <key>` in **Arguments** (see [If your tool ships the file](#if-your-tool-ships-the-file)). The key is then part of the script’s settings, so you need one upload per customer. On the Pro plan, uploaded .exe files can be at most 20 MB.

### Syncro

[Section titled “Syncro”](#syncro)

1. Create a custom field for the key. Go to **Admin**, and under **Customers** select **Customer Custom Fields** › **New Field**. Name it `Blink Enroll Key`, set **Field Type** to **Text Field** and click **Create Field**. Then fill in each customer’s key on that customer’s record. (Syncro is renaming Customers to Organizations, so some screens may say Organization instead.)

2. Go to **Scripts** › **+New Script**. Set **File Type** to **PowerShell**, **Run As** to **System**, and **Max Script Run Time (minutes)** to at least `5`.

3. Click **Add Script Variable** and add a variable named `EnrollKey` of type **Platform**. For its value, choose `{{customer_custom_field_blink_enroll_key}}`. Syncro builds this name from the field name in lower case, with spaces turned into underscores, so it must match the field you created. When the script runs, `$EnrollKey` holds the key of the asset’s customer.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add only the address:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   ```

   Do not set `$EnrollKey` in the script. It comes from the variable. Do not use a **Runtime** variable for the address either: Syncro asks for runtime values every time someone schedules the script.

5. Click **Create Script**. To run it, open an asset’s **Scripts** tab, click **+Add to Queue** and choose **System** under **Run As**. For several assets at once, tick them and choose **Run Script…** from **Bulk Actions**. To cover new computers too, add it to a policy’s **Scripting** category as a **Setup Script** or under **Script Schedules**.

Each run’s result and output are in the asset’s **Scripts** tab under **Script History**. The script returns the agent’s exit code, and Syncro uses a non-zero code to flag the run as failed. On a failure the output includes the end of `install.log`.

Caution

Syncro custom fields have no masked type, so anyone who can open the customer in Syncro can read the key. Give each key a **Max uses** close to the number of computers and a short expiry, and revoke it when the rollout is done.

Tip

If the computers cannot download from your Blink address, use the [file directly](#if-your-tool-ships-the-file). In **Scripts**, click **Add New File** and upload `blink-agent.exe`. Then edit the script, click **+Add Required File**, choose the file, and in **Destination File Name** enter a full path that ends in the file name, for example `C:\Windows\Temp\blink-agent.exe`. Keep the `EnrollKey` variable and use this script instead:

```powershell
$p = Start-Process -FilePath 'C:\Windows\Temp\blink-agent.exe' -ArgumentList '--install', '--enroll', $EnrollKey -Wait -PassThru
exit $p.ExitCode
```

### SuperOps

[Section titled “SuperOps”](#superops)

1. Create a client custom field for the key, for example **Blink Enroll Key**: go to **Settings** › **Advanced Configuration** › **Manage Fields**, open the client fields and select **+ Create**. Fill in each customer’s key under **Additional properties** on that client’s profile.

2. Go to **Modules** › **Scripts** and select **+Script**. Set the language to **PowerShell**, set **Run as** to the system (root) user rather than the logged-in user, and set **Script timeout** to at least 5 minutes.

3. Select **+ Add placeholder variables**, enter `BlinkCustomerKey` as the name, and pick your **Blink Enroll Key** client field from the dropdown.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = "$BlinkCustomerKey"
   ```

5. Save the script. Run it from **Modules** › **Assets** (tick the customer’s computers and select **Run script**), or add it to a policy so new computers get the agent too.

Variable names in SuperOps

SuperOps fills in `$BlinkCustomerKey` wherever that name appears in the script. Keep the double quotes, because SuperOps does not fill in a name inside single quotes. Do not name a SuperOps variable `BlinkAddress`, `EnrollKey` or any part of those names, because SuperOps would also replace the script’s own variables and break it.

If you would rather type the key when you run the script, select **+ Add run time variables** with the same name instead of a placeholder variable. SuperOps asks for the value each time you run the script, or once when you add it to a policy.

SuperOps has no secure script variable, so treat the client field as readable by your team and revoke the key when the rollout is done.

### Action1

[Section titled “Action1”](#action1)

Action1 runs scripts as the Local System account. You add the script to your **Script Library** once, then run it in each customer’s organization with that customer’s key.

1. Go to **Configuration** › **Script Library** and select **New Script**. Enter a name, then on the **Script** step set the language to PowerShell and paste the PowerShell script.

2. Replace the line `# >>> Lines for your tool go here (see the steps for your tool). <<<` with these two lines. Action1 hands parameters to PowerShell scripts as variables named after the parameter:

   ```powershell
   $BlinkAddress = "$BLINK_ADDRESS"
   $EnrollKey    = "$BLINK_ENROLL_KEY"
   ```

3. In the **Parameters** section, select **Add parameter** and add `BLINK_ADDRESS` and `BLINK_ENROLL_KEY`, both of type **String**. Give `BLINK_ADDRESS` your Blink address as its default value. Do not put a real key in the default value of `BLINK_ENROLL_KEY`: Script Library scripts are available to every Action1 user in your enterprise who can use scripts.

4. Leave the script’s exit codes empty. Action1 uses the codes you enter there to decide when to restart the computer, not to decide whether the script worked.

5. On the **Test** step you can run the script on one computer with a key typed in. This really installs the agent and enrolls that computer, so only test on a computer of the customer whose key you use. Then finish the wizard.

6. For each customer, switch to that customer’s organization at the top of the **Endpoints** page, select the computers and select **Run Script**. Pick the script from the Script Library, enter that customer’s key as `BLINK_ENROLL_KEY`, and in the reboot options choose **Do not reboot automatically**. To reach computers that are offline right now, schedule the run instead of running it now, and set an **Automation completion deadline** under **Missed schedule retry and maintenance window**.

7. Check the result under **Automations** › **History**. The job output shows the script’s messages, and on a failure the end of the agent’s install log.

If you prefer the Command Prompt script, set the language to CMD and add the same two **String** parameters. Action1 passes CMD parameters as environment variables, which the script reads, so you can paste it as is: its two `set` lines only fill in values that are missing.

Caution

Action1 has no hidden or password parameter type, so the key is stored and shown as plain text. Give each customer’s key a **Max uses** that fits the rollout and a short expiry, and revoke it when you are done.

Note

If your Action1 enterprise uses Endpoint Takeover Prevention, an Enterprise Admin must sign the script and the automations that run it with their Action1 Key, or computers block them. If your enterprise requires signed PowerShell scripts, sign the script after adding the two lines and upload the file instead of pasting it.

Tip

Use the script rather than a **Software Repository** package. Action1 recognizes a package by its display name in the computer’s installed apps, and the Access agent does not add itself there, so Action1 cannot tell whether it is installed.

### Level

[Section titled “Level”](#level)

1. Go to **Workspace** › **Custom Fields** and select **+ Add custom field**. Name it, for example, `blink_enroll_key`, leave **Field value** empty, turn on **Admin only**, and select **Add custom field**. Admin only hides the value in the web interface from everyone except account administrators. Scripts can still use it.

2. Set the key for each customer on their group. Go to **Devices**, select the customer’s group, open **Custom fields**, select **⋮** › **Edit** on the field, enter the key in **Field value** and select **Update custom field**. Level uses the most specific value it finds: device, then group, then the global value. Do not put a key in the global value, or every customer would enroll into the same Blink organization.

3. Go to **Scripts** and select **+ Create script**. Set the language to **PowerShell**, **Run as** to **Local system**, and **Timeout (in seconds)** to at least `600`. The default is 100 seconds, and a script that runs longer is marked as failed.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add the lines below. Insert the field with the **{x}** button in the editor so its name matches exactly. If a group has no key, Level leaves the placeholder in place, which the script treats as missing: it stops with exit code `2`. Then select **Save script**.

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '{{cf_blink_enroll_key}}'
   ```

5. Go to **Automations**, select **+ Create automation**, add the **Run script** action (under **System**) and pick your script. Add a trigger, or use **Add a device** to run it on the computers you choose. To try it on a few computers first, select them in the device list and choose **Actions** › **Run saved script**. Level asks you to approve that run before it starts.

Level marks the step as failed when the script exits with any code other than `0`. To read the script’s output, open the run on the automation’s **History** tab and expand the step. Computers that are offline run the automation when they next come online.

### Tactical RMM

[Section titled “Tactical RMM”](#tactical-rmm)

Tactical RMM runs scripts as SYSTEM with Windows PowerShell. It has no masked field type, so keep the key in a client custom field and pass it as an environment variable. Tactical RMM does not log environment variables, while **Script Arguments** end up in the computer’s PowerShell event log.

1. Go to **Settings** › **Global Settings** › **Custom Fields** and select **Add custom field**. Set **Target** to **Client**, **Name** to `BlinkEnrollKey` and **Field Type** to **Text**, then select **Submit**. Leave **Hide in Dashboard** clear: it hides the field from the client form where you enter the key.

2. For each client, right-click it in the client tree, select **Edit**, enter its key under **Custom Fields** and select **Save**. Anyone who can edit the client can see the key.

3. Go to **Settings** › **Script Manager** › **New** › **New Script**. Set **Shell Type** to **Powershell** and paste the PowerShell script. Change its last line from `exit $code` to:

   ```powershell
   $host.SetShouldExit($code); exit $code
   ```

   Tactical RMM reports a plain `exit` with any code other than 0 as 1. This line passes the agent’s real exit code through, for example 20 or 21. The script’s earlier exits, including `exit 2`, still show as 1, which still counts as a failure.

4. In **Environment vars**, type each of these lines and press Enter after each one:

   ```plaintext
   BLINK_ADDRESS=https://yourname.onblink.cloud
   BLINK_ENROLL_KEY={{client.BlinkEnrollKey}}
   ```

   The name between `{{ }}` is case sensitive and must match the custom field exactly. If a client’s field is empty, Tactical RMM leaves the variable out. The script then prints “Blink: set the Blink address and the enrollment key.” and Tactical RMM shows exit code 1.

5. Set **Timeout (seconds)** to `600`. With the default of 90 seconds, the job can be stopped during the download or install, and Tactical RMM then reports exit code 98.

6. Leave **Run As User (Windows only)** clear, so the script runs as SYSTEM, and select **Save**.

7. Run it: right-click an agent and select **Run Script**, or use **Tools** › **Bulk Script** for a client or site. Leave **Run As User** clear there too. To reach new computers as they are added, go to **Settings** › **Automation Manager** and add the script to a policy as a task with **Task run type** set to **Onboarding**.

Note

The run forms and new tasks copy the script’s environment vars and timeout when you pick the script. A task you added earlier keeps its old values. **Run Script** with **Wait for Output** shows the script output and the **Return Code**. Runs from **Bulk Script** and tasks are listed on the agent’s **History** tab.

### Pulseway

[Section titled “Pulseway”](#pulseway)

Pulseway has no secret or password-type field: custom fields and script variables are plain **Text**, **Number**, **Date** or **Boolean**. Keep the key in a custom field rather than in the script text, and revoke it when the rollout is done.

1. Go to **Automation** › **Custom Fields** and create a **Text** custom field for the key, for example `BlinkEnrollKey`, with the **Organization** context. Set its value on each customer organization. A value set on a computer itself takes priority over the organization’s, so leave it empty at that level.

2. Go to **Automation** › **Automation Hub**, open **User Defined** (or a folder in it) and select **Create Script**.

3. Enable the script for **Windows**, choose **PowerShell** and paste the PowerShell script.

4. Add an input variable named `EnrollKey` (no `$`), of type **Text**, and bind it to your key field. Pulseway adds a line such as `$EnrollKey = '...';` at the top of the script for you.

5. In place of the “Lines for your tool” comment, add only the address:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   ```

6. Save the script. To test it on one computer, select the computer in **Device Management** and use **Action** › **Run Script**. For the rollout, create a task on the **Automation Hub** page with a scope that covers the customer’s computers.

Pulseway marks a script as failed when it exits with a code other than `0`, so a refused install shows as failed, with the script output. A computer whose organization has no key value exits with code `2`.

PowerShell User Impersonation

Pulseway runs scripts as the system account by default. If **PowerShell User Impersonation** is turned on for a computer (Pulseway Manager › **Settings** › **Runtime**), PowerShell scripts run as the configured user instead. That user must be a local administrator for the install to work.

### LogMeIn Resolve

[Section titled “LogMeIn Resolve”](#logmein-resolve)

LogMeIn Resolve was called GoTo Resolve until 2025.

1. Go to **Devices** › **Remote Execution** and select **Create new job**.
2. Under **Scripting**, add a **PowerShell execution** step and paste the PowerShell script. In place of the “Lines for your tool” comment, set `$BlinkAddress` and `$EnrollKey`.
3. Choose the customer’s devices. Turn on **Retry job for offline devices** to catch computers that are switched off, then select **Run**.

Scripts run as the system account, and each step may take up to two hours. The key is part of the script text, so give it a **Max uses** close to the number of computers and a short expiry. If a device shows **Job failed**, select **View logs**: the script prints the reason on a line starting with `Blink:`.

### ManageEngine Endpoint Central

[Section titled “ManageEngine Endpoint Central”](#manageengine-endpoint-central)

The menus are the same in Endpoint Central MSP. Use one configuration per customer, each with that customer’s enrollment key.

1. Save the PowerShell script as `install-blink.ps1`. Go to **Configurations** › **Script Repository** › **Add Script** and upload it. Type the file name yourself rather than pasting it.

2. Go to **Configurations** › **Add Configurations** › **Windows Configuration** › **Custom Script** › **Computer Configuration**.

3. Choose **Repository** and pick `install-blink.ps1` in **Script Name**.

4. In **Script Arguments**, enter the address and the key, separated by a space and without quotes:

   ```plaintext
   https://yourname.onblink.cloud <key>
   ```

   Select **Mask Sensitive Data** so the key is hidden from end users during deployment.

5. Leave **Exit codes** at `0`, so any other code shows as failed.

6. Set **Frequency** to **Once** and select **Enable logging for troubleshooting**. The script’s output, including the end of the install log on a failure, then shows in **Remarks**.

7. Set **Run As** to **System user**.

8. Define the targets and click **Deploy Immediately**.

Check the result per computer under **Execution Status** and **Remarks**. By default, Endpoint Central gives a script 60 minutes and then reports **The wait operation timed out - Error Code: 258**.

Caution

**Mask Sensitive Data** hides the key from end users, but console users with the right scope and role can still see it through **View Script**. Never type the key into the script itself.

You can also deploy the file as a software package (see [If your tool ships the file](#if-your-tool-ships-the-file)). Go to **Software Deployment** › **Package Creation** › **Packages** › **Add Package** › **Windows**, choose the package type **EXE/APPX/MSIEXEC/MSU/MSIX/MSIX Bundle**, select **From Local Computer** and upload `blink-agent.exe`. In **Installation Command with Switches/Arguments**, enter:

```bat
blink-agent.exe --install --enroll <key>
```

Under **Advanced Settings**, make sure **Exit Code** lists `0`. Deploy it from **Software Deployment** › **Deployment** › **Install/Uninstall Software** › **Windows** › **Computer Configuration**, with **Install As** set to **System User**, and click **Deploy Immediately**. **Deploy** waits for the next 90-minute refresh cycle or startup. The key is part of the package command, so create one package per customer.

### Automox

[Section titled “Automox”](#automox)

Use a Worklet, not a Required Software policy: the agent does not appear in the list of installed programs, which is what a Required Software policy checks.

1. Go to **Settings** › **Secrets & Keys**, select **Add Secret**, and save the customer’s key as a secret, for example named `Blink enroll key`.

2. Go to **Automate** › **Policies** › **Create Policy**, and in the Worklets section choose **Windows**. Enter a **Policy Name**.

3. Under **Inputs**, select **Add Input**. Set **Variable Name** to `BLINK_ENROLL_KEY` and choose your secret in **Select Organization Secret**.

4. In **Scope**, put this in the evaluation code. It tells Automox to install only where the agent is not running:

   ```powershell
   $s = Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue
   if ($s -and $s.Status -eq 'Running') { exit 0 } else { exit 1 }
   ```

5. Paste the PowerShell script into the remediation code. In place of the “Lines for your tool” comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = $BLINK_ENROLL_KEY
   ```

6. Set a **Schedule**, use **Associate Groups** to pick the customer’s groups, and select **Create Policy**.

Worklets run as the system account in 32-bit PowerShell, which the script handles. When you run the policy by hand, Automox skips the evaluation code and runs the remediation code directly, which is safe: the script does nothing on computers that already run the agent.

### JumpCloud

[Section titled “JumpCloud”](#jumpcloud)

1. Go to **Settings** › **Automation Variables** and select **+Variable**. Name it, for example, `blink_enroll_key`, choose the **String** data type, paste the customer’s key as the **Value**, and turn on **Secret Variable**. Create it in each customer’s organization.

2. Go to **Device Management** › **Commands**, select **+ Command** › **Command**, set **Type** to **Windows** and set the command to run as PowerShell.

3. Paste the PowerShell script into **Command**. In place of the “Lines for your tool” comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = {{blink_enroll_key}}
   ```

   Do not put quotes around `{{blink_enroll_key}}`: JumpCloud adds them when the command runs.

4. Set **Timeout After** to at least `300` seconds.

5. On the **Device Groups** or **Devices** tab, choose the customer’s computers, select **Save**, then **Run Now**.

Commands run as the system account in a 32-bit process, which the script handles.

### ImmyBot

[Section titled “ImmyBot”](#immybot)

ImmyBot uploads the file itself and hands each customer’s key to the install script from a tenant license.

1. Go to **Library** › **Software** › **New**. Set **Installer Type** to **File**, choose **Full Installer Package**, and upload `blink-agent.exe` (see [If your tool ships the file](#if-your-tool-ships-the-file)).

2. Name the software, for example `IZT Blink Access agent`, and enter the uploaded file’s version as the **Version String**.

3. For the detection method, choose a custom detection script that runs as **System**:

   ```powershell
   $exe = Join-Path $env:ProgramData 'Blink\blink-agent.exe'
   if ((Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue) -and (Test-Path $exe)) {
       (Get-Item $exe).VersionInfo.ProductVersion
   }
   ```

   The agent does not appear in the list of installed programs, so detection by display name does not find it.

4. Under **Installation**, select **New**, set the execution context to **System**, and use:

   ```powershell
   $p = Start-Process -FilePath $InstallerFile -ArgumentList '--install', '--enroll', $LicenseValue -Wait -PassThru -NoNewWindow
   if ($p.ExitCode -ne 0) { throw "Blink: the install failed with exit code $($p.ExitCode)." }
   ```

5. Make the software require a license, and add a license key for each tenant that holds that customer’s enrollment key. ImmyBot passes it to the install script as `$LicenseValue`.

6. Go to **Deployments** › **New**, choose **Software** and this software, set the enforcement to **Required**, and target **Single Tenant** with that customer’s computers. The deployment applies the next time a maintenance session runs.

The agent [updates itself](/install/agent-updates/), so the installed version soon becomes newer than the one you uploaded.

### Microsoft Intune

[Section titled “Microsoft Intune”](#microsoft-intune)

Intune runs the PowerShell script as a Win32 app. Win32 apps have no script variables or per-customer fields, so the address and key go into the install command. Create one app for each customer tenant, or for each enrollment key. Win32 apps need Windows Pro, Enterprise or Education.

1. Save the PowerShell script as `install-blink.ps1` in an empty folder, for example `C:\BlinkPackage`. Wrap it into an `.intunewin` file with the Microsoft Win32 Content Prep Tool:

   ```bat
   IntuneWinAppUtil.exe -c C:\BlinkPackage -s C:\BlinkPackage\install-blink.ps1 -o C:\BlinkOutput
   ```

   Keep `IntuneWinAppUtil.exe` itself out of that folder, because everything in the folder goes into the package.

2. In the Microsoft Intune admin center, go to **Apps** › **All Apps** › **Create**. Choose the **Windows** platform, then **Windows app (Win32)**, and click **Select**. Click **Select app package file** and upload the `.intunewin` file.

3. On **Program**, set:

   * **Installer type**: **Command line**.

   * **Install command**:

     ```bat
     %SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File install-blink.ps1 https://yourname.onblink.cloud <key>
     ```

     Keep the `Sysnative` path. A plain `powershell.exe` in this field starts 32-bit PowerShell.

   * **Uninstall command**: `"C:\ProgramData\Blink\blink-agent.exe" --uninstall`. Intune does not expand environment variables in this field, so keep the full path.

   * **Install behavior**: **System**.

   * Leave the return codes as they are. `0` is **Success**. Any exit code that is not on the list, such as `1`, `2`, `20` or `21`, shows as a failed install.

4. On **Requirements**, set **Operating system architecture** to x64 and **Minimum operating system** to the oldest Windows 10 or 11 release you support.

5. On **Detection rules**, choose **Manually configure detection rules** and add a **Registry** rule:

   * **Key path**: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BlinkAgent`
   * **Value name**: leave empty.
   * **Detection method**: **Key exists**.
   * **Associated with a 32-bit app on 64-bit clients**: **No**.

6. On **Assignments**, under **Required**, select **Add group** and choose a group with the customer’s devices. Then click **Create** on **Review + create**.

Caution

Anyone who can view the app in Intune can see the key in the install command, and the Intune Management Extension logs in `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs` on each computer can contain it too. Give the key a **Max uses** close to the number of computers and a short expiry, and revoke it when the rollout is done.

If an install shows as failed, open `C:\ProgramData\Blink\install.log` on the computer to see why. `AppWorkload.log` in the folder above shows the exit code Intune received.

### Microsoft Configuration Manager

[Section titled “Microsoft Configuration Manager”](#microsoft-configuration-manager)

Configuration Manager installs the agent as an application. You do not need the script: use the file directly (see [If your tool ships the file](#if-your-tool-ships-the-file)).

1. Put `blink-agent.exe` in a folder of its own on a network share that the site server’s computer account can read.

2. In the Configuration Manager console, go to **Software Library** › **Application Management** › **Applications** and select **Create Application**. Choose **Manually specify the application information** and give it a name.

3. On the **Deployment Types** page, select **Add**, set **Type** to **Script Installer** and choose **Manually specify the deployment type information**.

4. On the **Content** page, set:

   * **Content location**: the folder from step 1.
   * **Installation program**: `blink-agent.exe --install --enroll <key>`
   * **Uninstall program**: `"C:\ProgramData\Blink\blink-agent.exe" --uninstall`

   Leave **Run installation and uninstall program as 32-bit process on 64-bit clients** cleared.

5. On the **Detection Method** page, select **Add Clause** and add a **Registry** rule: **Hive** `HKEY_LOCAL_MACHINE`, **Key** `SYSTEM\CurrentControlSet\Services\BlinkAgent`, with no value, so the key only has to exist.

6. On the **User Experience** page, set **Installation behavior** to **Install for system**, **Logon requirement** to **Whether or not a user is logged on**, and **Installation program visibility** to **Hidden**.

7. Finish the wizard, distribute the content to your distribution points, and deploy the application to a device collection with the purpose **Required**.

The default return codes of a Script Installer count only `0` as success (plus the restart and retry codes), so `1`, `20` and `21` show as failed. The key is part of the installation program, which every console user who can read the application can see, so give it a **Max uses** close to the number of computers and revoke it when the rollout is done.

### Group Policy

[Section titled “Group Policy”](#group-policy)

Use the Command Prompt script as a computer startup script. Group Policy has no secure field, so the key goes in the script file itself.

1. Save the Command Prompt script as `install-blink.cmd`, with your Blink address and the enrollment key filled in on the two `set` lines.
2. In **Group Policy Management**, right-click the organizational unit that holds the computers (not the users) and select **Create a GPO in this domain, and Link it here**. Name it, then right-click the new Group Policy Object and select **Edit**.
3. Go to **Computer Configuration** › **Policies** › **Windows Settings** › **Scripts (Startup/Shutdown)** and double-click **Startup**.
4. Select **Show Files** and copy `install-blink.cmd` into the folder that opens. The file is then stored with the Group Policy Object, where the computers can read it at start-up.
5. Back in **Startup Properties**, select **Add**, then **Browse**. Pick `install-blink.cmd` from that same folder, then select **OK** in both dialogs.

Startup scripts run as the local system account when the computer starts, so each computer needs a restart. By default Windows applies Group Policy in the background while it starts, so a computer may need more than one restart before it runs the script. To make computers wait for the network and apply the policy on the first restart, enable **Always wait for the network at computer startup and logon** under **Computer Configuration** › **Policies** › **Administrative Templates** › **System** › **Logon**. A computer that is off the company network when it starts does not run the script. It runs it at a later restart on the network.

On computers that already run the agent, the script ends straight away, so it does no harm on later restarts.

By default Windows gives all Group Policy scripts together 10 minutes, then stops them. If you already run other long startup scripts, enable **Specify maximum wait time for Group Policy scripts** under **Computer Configuration** › **Policies** › **Administrative Templates** › **System** › **Scripts** and raise the time.

Group Policy does not show you whether the install worked. Use [Check the rollout](#check-the-rollout) to see which computers enrolled.

Caution

The script, with the key, is stored in SYSVOL. By default every user in the domain can read it, and so can anyone with administrator rights on a domain computer. Give the key a **Max uses** close to the number of computers and a short expiry. When the rollout is done, remove the script in **Startup Properties**, delete the file in **Show Files** (**Remove** only takes it off the list) and revoke the key.

### PDQ Deploy and PDQ Connect

[Section titled “PDQ Deploy and PDQ Connect”](#pdq-deploy-and-pdq-connect)

You do not need the script. Both tools copy an EXE to the computer and run it with your parameters. First download `blink-agent.exe` (see [If your tool ships the file](#if-your-tool-ships-the-file)).

**PDQ Deploy**

1. Select **New Package** on the toolbar (or **File** › **New Package**) and give the package a name that includes the customer. A new package has no steps yet.
2. Select **New Step** › **Install**. Set **Install File** to `blink-agent.exe` and **Parameters** to `--install --enroll <key>`.
3. Leave **Success Codes** as they are. The defaults are `0`, `1641` and `3010`, so the agent’s `1`, `2`, `20` and `21` show as errors with the code. Save the package.
4. Select **Deploy Once**, add the customer’s computers with **Choose Targets**, then select **Deploy Now**. The package runs as your Deploy User, which must be an administrator on the computers. There is no need to change **Run As**.

**PDQ Connect**

1. Go to **Packages** › **Create package** and name it.
2. Select **Add install step**, then **Attach installer file** and choose `blink-agent.exe`. In **Parameters**, enter `--install --enroll <key>`.
3. Check that **Success codes** does not list `1`, `2`, `20` or `21`, so those show as failed. Then select **Save**.
4. On the **Packages** page, select the package, then **Actions** › **Deploy**. Choose the customer’s devices and select **Deploy**.

Caution

The key is stored in plain text in the package’s **Parameters**. PDQ Deploy also shows it in the step’s **Command Line**. Anyone who can open the package, or an exported copy of it, can read the key. Make one package per customer (one per enrollment key), and revoke the key when the rollout is done.

## Switch from your old remote access tool

[Section titled “Switch from your old remote access tool”](#switch-from-your-old-remote-access-tool)

Put Blink on first, and remove the old tool only once each computer shows **online** in Blink, so you never lose access in between.

1. Roll out the Access agent with the steps above, or [through the old tool itself](#use-the-old-tool-to-install-blink).
2. In Blink, open **Access** in each organization and check that every computer shows **online**. See [Check the rollout](#check-the-rollout).
3. Remove the old tool from those computers.
4. If your RMM tool installs a remote access tool of its own (for example Splashtop or AnyDesk), turn that integration off in the RMM, or it may install the tool again.

### Use the old tool to install Blink

[Section titled “Use the old tool to install Blink”](#use-the-old-tool-to-install-blink)

**ConnectWise ScreenConnect.** Its Access agents run commands as the system account:

1. On the host page, open **Access** and tick the sessions of one customer.

2. Right-click them and select **Run Command**.

3. Enter these three lines, then the PowerShell script, with `$BlinkAddress` and `$EnrollKey` set in place of the “Lines for your tool” comment:

   ```plaintext
   #!ps
   #timeout=300000
   #maxlength=100000
   ```

   `#!ps` sends the command to PowerShell, `#timeout` gives it 5 minutes instead of the default 10 seconds, and `#maxlength` keeps the whole output.

4. Read each session’s output: the last line starts with `Blink:` and says what happened.

ScreenConnect keeps the command, key included, in the session history and the audit log, so revoke the key when the rollout is done.

**Splashtop.** With Splashtop Autonomous Endpoint Management (AEM), go to **Automation** › **Scripts & Tasks** and select **Create Action** › **Batch/Executable File**. Upload `blink-agent.exe` (see [If your tool ships the file](#if-your-tool-ships-the-file)), enter `--install --enroll <key>` in **Parameters**, then select **Save and Run**, choose the customer’s computers and enter an administrator account for them. Use one action per customer.

### Remove the old tool

[Section titled “Remove the old tool”](#remove-the-old-tool)

| Tool                      | How to remove it                                                                                                                               |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| ConnectWise ScreenConnect | On the host page, select the sessions, then **Uninstall** › **Uninstall and Delete**. **Delete** on its own leaves the client on the computer. |
| AnyDesk                   | `"%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" --silent --remove`                                                                                  |
| Splashtop Streamer        | Uninstall it silently with `msiexec /qn /x` and the Streamer’s product code, as described in Splashtop’s own help.                             |
| TeamViewer                | Use your TeamViewer management console or TeamViewer’s documented uninstall. Test any silent uninstall command on one computer first.          |

## Check the rollout

[Section titled “Check the rollout”](#check-the-rollout)

* In Blink, open **Access** in each organization. Enrolled computers appear with their name, OS and agent version, and show **online** once the service connects. See [Manage Access devices](/use/manage-devices/).

* In your tool, look at the job results. Anything other than exit code `0` needs a look:

  * `1`: read the job output (the PowerShell script prints the end of `install.log`), or `C:\ProgramData\Blink\install.log` on the computer. Common causes: the computer cannot reach your Blink address, a security tool blocked the download, the key is wrong, used up, expired or revoked.
  * `2`: the script did not receive the address or the key. Check the variable or field for that customer.
  * `20`: every Access device in your plan is in use. Free one or add devices to your plan, then run the job again for the computers that failed.
  * `21`: your plan does not include **Unattended Access**.

* Computers that enrolled but stay **offline**: check for a proxy or HTTPS inspection, and see [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).

## Remove the agent with your tool

[Section titled “Remove the agent with your tool”](#remove-the-agent-with-your-tool)

To take the agent off computers, run this as the system account:

```bat
"C:\ProgramData\Blink\blink-agent.exe" --uninstall
```

It exits with `0` on success and `1` on failure. Then revoke or delete the devices in the console. See [Uninstall the Access agent](/install/uninstall-the-agent/).

# Create an enrollment key

> Create the key that lets the Access agent register a computer into your organization, and keep it under control.

An enrollment key lets the Access agent register a computer into one organization. You create keys in the console under **Enrollment**, inside the organization the computers belong to. You need the **Enroll devices** permission there, and your plan must include **Unattended Access**: without it, **Enrollment** does not appear in the console.

Note

You do not need a key when you [install Access from a support session](/install/access-agent-windows/#install-from-a-support-session): Blink creates a one-time key for that install itself.

## Create a key

[Section titled “Create a key”](#create-a-key)

1. In the console, switch to the organization the computers belong to and open **Enrollment**.

2. Select **New key**.

3. Fill in the form:

   * **Label**: a name you will recognise later, for example `Acme HQ rollout, Oct`.
   * **Seed group**: computers enrolled with this key join this device group. Choose **No group** to leave them ungrouped.
   * **Max uses**: how many computers may enroll with the key. `0` means unlimited.
   * **Expires in days**: from 1 to 365. The default is 90.
   * **Allow re-enrollment** (shown only if you have the **Remove devices** permission for that group): lets a computer that is already enrolled in this key’s group register a new device key with this key.

4. Select **Create key**.

The new key appears at the top of the page, marked **New key · shown once**.

5. Select **Copy key**, or download an installer straight away (see [Install the Access agent on Windows](/install/access-agent-windows/)).
6. Select **Done** when you are finished.

The key is shown only once

Blink keeps only a hash of the key, so it cannot show it again. If you lose it, create a new one. The signed installer for a key can also only be downloaded while the key is on screen.

## Access devices in your plan

[Section titled “Access devices in your plan”](#access-devices-in-your-plan)

Each computer that enrolls takes one Access device in your plan. If you can see the license (the **View license** permission), the top of the **Enrollment** page shows how many are in use, for example `12 of 25 Access devices`.

When every Access device is in use, the page warns: **All Access devices in your plan are in use: new computers cannot enroll until a device is removed or devices are added to your plan. Devices already enrolled keep working.** You can still create keys, because a key is not a device, but enrolling with it is refused until a device is free. To free one, revoke or delete a device you no longer manage (see [Manage Access devices](/use/manage-devices/)), or ask for more devices in your plan. See [Access devices](/configure/plans-and-limits/#access-devices).

## Keep keys under control

[Section titled “Keep keys under control”](#keep-keys-under-control)

A key built into an installer can be recovered from that file. Treat installers like passwords:

* Use one key per rollout.
* Set a small **Max uses** and a short expiry.
* Revoke the key when the rollout is done.

Every key expires. The key table shows each key’s **Label**, **Group**, **Uses**, **Expires** and **Status** (**active**, **used up**, **expired** or **revoked**). Tick **Show revoked and expired** to see old keys too.

### Change a key

[Section titled “Change a key”](#change-a-key)

Select **Edit** on a key that is not revoked to change its **Label**, **Max uses**, or set a **New expiry in days from now** (1 to 365). Leave the expiry empty to keep the current one.

### Revoke a key

[Section titled “Revoke a key”](#revoke-a-key)

Select **Revoke** on the key and confirm with **Revoke key**. Installers carrying it stop enrolling immediately. Computers already enrolled with it are not affected. You need the **Revoke enrollment keys** permission.

## Rules worth knowing

[Section titled “Rules worth knowing”](#rules-worth-knowing)

* A computer that is already enrolled cannot enroll again with a new device key unless the key allows re-enrollment, or you delete the device in the console first.
* A computer whose agent was uninstalled can be enrolled again with a key for its device group, or with a key that has no group. It then takes an Access device in your plan again, so this is refused at the device limit.
* A revoked device never comes back through an enrollment key. Only **Un-revoke** on the device brings it back.

# Allow Blink on a Mac

> Grant the two macOS privacy permissions Blink needs, Screen Recording and Accessibility, and fix a switch that is on but not working.

macOS does not let any app see or control the screen until the person at the Mac allows it. Blink needs two permissions, and only the person at the Mac can grant them: no technician or Blink setting can do it for them.

| Permission in System Settings                          | What it allows                                            |
| ------------------------------------------------------ | --------------------------------------------------------- |
| **Screen & System Audio Recording** (Screen Recording) | The technician sees the screen and hears the Mac’s sound. |
| **Accessibility**                                      | The technician uses the mouse and keyboard.               |

Older macOS versions

The names above are the ones current macOS uses. On older versions the first list is called **Screen Recording**, and on macOS 12 the settings app is called **System Preferences** (**Security & Privacy** › **Privacy**).

Without Screen Recording, the technician sees nothing (see also [Fix a black screen or missing video](/troubleshooting/black-screen/)). Without Accessibility, the technician can watch but not control.

## Grant the permissions

[Section titled “Grant the permissions”](#grant-the-permissions)

When the support tool starts and a permission is missing, Blink opens a window titled **Blink remote support** that says **Your technician needs permission to see your screen**. It lists both permissions and updates by itself as they are granted.

1. In the Blink window, select **Open Settings** next to **Screen & System Audio Recording**. System Settings opens at that list.
2. Turn **Blink** on.
3. Screen Recording only takes effect once Blink starts again. Either Blink says **Screen Recording is allowed. Blink restarts to start sharing.** and shows a **Restart Blink** button, or it says to click **Quit & Reopen** when macOS asks. Do whichever it shows.
4. Back in the Blink window, select **Open Settings** next to **Accessibility** and turn **Blink** on.
5. The window says **All set. Your technician can now help you.** and closes on its own a few seconds later.

If the customer closed the window, the technician can show it again on the customer’s screen with **Ask the customer again** (or **Ask again**) in the viewer.

The technician’s viewer shows which permissions are still missing, so you can talk the customer through the step they are on.

## The switch is on but it still says not allowed

[Section titled “The switch is on but it still says not allowed”](#the-switch-is-on-but-it-still-says-not-allowed)

This happens when an older copy of Blink is still in the list: macOS ties the permission to that copy, not the one running now.

1. In **System Settings** › **Privacy & Security**, open the list that still says not allowed (**Screen & System Audio Recording** or **Accessibility**).
2. Select **Blink** and remove it with the **−** button.
3. Open Blink again and allow it when asked.

Blink shows the same tip at the bottom of its permission window.

## If macOS will not open Blink

[Section titled “If macOS will not open Blink”](#if-macos-will-not-open-blink)

If macOS says it cannot open the app, go to **System Settings** › **Privacy & Security**, scroll to the message about Blink and choose **Open Anyway**. See [Run the support tool](/install/support-tool/#on-a-mac).

## Ending the session

[Section titled “Ending the session”](#ending-the-session)

Blink shows in the menu bar while the session is live. Choose **End session** there to stop. The permissions stay granted in System Settings; the customer can turn them off there at any time.

# Install Blink on your own server

> Prepare a DNS name, open the ports, keep the data safe, and finish first-time setup on an on-premises Blink server.

This page is for customers who run Blink on their own hardware. If you use Blink in the cloud, IZT runs the server and you can skip to [Create an enrollment key](/install/enrollment-keys/).

The Blink server ships as a single container image. The console your technicians use and the join page your customers see are built into it, so there is no separate web server to set up.

## What you need

[Section titled “What you need”](#what-you-need)

* A **dedicated server** that meets the [server requirements](#server-requirements), with a **persistent volume** for the server’s data folder (`/data` inside the container).
* The **database** the server stores its data in. Contact [IZT](https://izt.app) for the server image and the database requirements.
* A **DNS name** for the server, for example `blink.example.com`.
* Your **license activation code** from IZT, or the license file if the server cannot reach the internet.

## Server requirements

[Section titled “Server requirements”](#server-requirements)

Blink needs a server of its own: a physical machine or a virtual machine running **Debian 13**, 64-bit (x64), with nothing else running on it. IZT installs Docker on it.

|             | Minimum                       | Recommended                    |
| ----------- | ----------------------------- | ------------------------------ |
| Technicians | Up to 10                      | Up to 50                       |
| CPU         | 2 vCPU (x64)                  | 4 vCPU (x64)                   |
| Memory      | 4 GB                          | 8 GB                           |
| Disk (SSD)  | 64 GB, plus recording storage | 128 GB, plus recording storage |

More than 50 technicians? Contact [IZT](https://izt.app) to size the server with you.

* Use SSD storage. Blink keeps its database, recordings and session logs on this disk.
* If your plan includes **Session recording**, add disk space for recordings on top of the figures above. See [Plan storage for recordings](#plan-storage-for-recordings).
* Give the server a fixed IP address, and a public one (or a port forward from one) so customers can reach it from anywhere. See [Open the ports](#open-the-ports).

### Plan storage for recordings

[Section titled “Plan storage for recordings”](#plan-storage-for-recordings)

Blink records every screen a technician watches, one recording per monitor, when your plan includes **Session recording** (part of Blink Pro). How much space a recording takes depends on what is on the screen:

| What is on the screen                                                  | About               |
| ---------------------------------------------------------------------- | ------------------- |
| Typical office work: settings, documents, email                        | 0.2 GB per hour     |
| **Planning figure**, for a mix of sessions                             | **1 GB per hour**   |
| Full-screen video or fast-moving graphics on a high-resolution monitor | Up to 5 GB per hour |

These figures are per monitor watched. Sound adds about 10 MB per hour, and terminal transcripts take next to nothing.

To estimate, multiply the hours your technicians spend watching screens by 1 GB, and by the number of days you keep recordings. For example: 5 technicians, each watching screens for 2 hours a day, 22 working days a month, is about 220 GB a month. Keeping recordings for 90 days needs about 660 GB of recording storage.

You set how long recordings are kept, and the most space they may use, with the `-recording-retention-days` and `-recording-quota-mb` options under [Server options](#server-options). By default, Blink keeps recordings forever, so set at least one of them, or watch the disk. See [Recording storage and log levels](/configure/recordings-and-logs/#how-long-recordings-are-kept).

## Choose the DNS name first

[Section titled “Choose the DNS name first”](#choose-the-dns-name-first)

Pick the name before you activate the license, and keep it. The license names the hostname, and every Access agent and support tool your server hands out is built to connect to `wss://<that name>/ws/agent`.

Point the name at the server’s public address. If you want a free Let’s Encrypt certificate, the name must resolve to this server from the internet.

## Open the ports

[Section titled “Open the ports”](#open-the-ports)

These are the server’s default ports. Publish every one of them from the container and allow them through the host and network firewalls.

| Port                      | Protocol    | Used for                                                                                                                     |
| ------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------- |
| 443 (container port 8443) | TCP         | The console, the join page, agent connections, and relayed media over HTTPS. Let’s Encrypt also checks the certificate here. |
| 8071                      | TCP and UDP | Session media (screen, audio, input)                                                                                         |
| 3478                      | TCP and UDP | Relay for sessions that cannot connect directly                                                                              |
| 2565                      | UDP         | Relay                                                                                                                        |
| 49152 to 51199            | UDP         | Relay sockets, one per relayed connection                                                                                    |

Publish the relay range explicitly

The image does not list the 49152 to 51199 UDP range, so `docker run -P` and tools that read the image’s ports leave it closed. Without it, relayed sessions connect but show no picture. Publish the range with `-p 49152-51199:49152-51199/udp`.

If the HTTPS port your users reach is not 443 (for example, a proxy or port forward in front of the server), tell the server with `-public-https-port`. Let’s Encrypt always connects on port 443, so forward TCP 443 to the server if you use it.

### Outbound access for online activation

[Section titled “Outbound access for online activation”](#outbound-access-for-online-activation)

To activate and renew the license online (see [Activate your license](/get-started/activate-your-license/)), the server must reach these hosts:

| Host                    | Port    | Used for                                                    |
| ----------------------- | ------- | ----------------------------------------------------------- |
| `license.blink.izt.app` | 443/TCP | License activation and renewal                              |
| `build.blink.izt.app`   | 443/TCP | License activation and renewal, agent downloads and updates |

Without them, activate offline with a license file instead.

## Server options

[Section titled “Server options”](#server-options)

The container’s arguments are the server’s options. The ones most installations set:

| Option                                        | What it does                                                                                                                                                                                                                   |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-agent-url wss://blink.example.com/ws/agent` | This server’s agent address. Set it to `wss://<your licensed DNS name>/ws/agent`. Agents are always built with the licensed name; if this option is missing or names another host, **Instance** › **License** shows a warning. |
| `-public-https-port 443`                      | The port users reach the HTTPS listener on, when it differs from the container port.                                                                                                                                           |
| `-public-ip 203.0.113.10`                     | The public IP address to advertise for media, when the server sits behind a one-to-one NAT.                                                                                                                                    |
| `-recording-retention-days 90`                | Delete finished recordings older than this many days. Default: keep them forever.                                                                                                                                              |
| `-recording-quota-mb 500000`                  | Delete the oldest finished recordings once recordings and terminal transcripts use more than this many MiB. Default: no limit.                                                                                                 |

A typical start looks like this. Replace the image and database placeholders with what IZT gave you.

```sh
docker run -d --name blink --stop-timeout 45 \
  -v blink-data:/data \
  <database settings from IZT> \
  -p 443:8443 -p 8071:8071 -p 8071:8071/udp \
  -p 3478:3478 -p 3478:3478/udp -p 2565:2565/udp \
  -p 49152-51199:49152-51199/udp \
  <blink-server-image> \
  -agent-url wss://blink.example.com/ws/agent -public-https-port 443
```

* `--stop-timeout 45` gives the server 45 seconds to stop cleanly: it pauses live sessions and finishes recordings before it exits.
* The container checks its own health. `docker ps` shows it as `healthy` once the server process is up.

## Where your data lives

[Section titled “Where your data lives”](#where-your-data-lives)

Blink keeps its data in two places. Back up both: see [Back up and restore the server](/install/back-up-and-restore/).

* **The database:** accounts, organizations, settings, devices, session history and logs, recordings, and uploaded certificates. Every secret in it is encrypted.
* **The data folder** (`/data`, on the volume): the database key that unlocks those secrets (in `/data/secrets`), and a cache of the agent builds the server hands out.

Keep the data volume

Always mount a named volume at `/data`. Without the database key in it, a copy of the database cannot be used. If you run the container without `-v`, Docker keeps the folder in an anonymous volume that `docker rm -v` deletes.

## First-time setup

[Section titled “First-time setup”](#first-time-setup)

The first time the server starts with an empty database, it prints a **setup token** to its log and its console:

```text
  Blink first-time setup: open /setup and enter the setup token


      <token>
```

1. Open `https://<your DNS name>/setup` in a browser. If your certificate is not set up yet, the browser warns about the built-in certificate; that is expected the first time.
2. Fill in **First name**, **Last name**, **Email**, a **Password** of at least 8 characters, **Confirm password**, and your **Organization** (your company or team).
3. Paste the **Setup token** from the server log (`docker logs blink`) and select **Create owner account**.
4. Set up two-factor sign-in: add the **Setup key** to an authenticator app, enter the **6-digit code** and select **Verify and enable**.
5. Save the recovery codes that appear, then select **I’ve saved them, continue**.
6. Create the **recovery kit** (see below). Setup is finished only when the kit is confirmed.

The owner account you create gets every permission on the server and in your first organization. Once setup is finished, `/setup` sends you to the sign-in page.

### Create the recovery kit

[Section titled “Create the recovery kit”](#create-the-recovery-kit)

The recovery kit is two files locked with a passphrase you choose:

* **Recovery key** (`blink-recovery-<instance>-<date>.json`): replaces the server’s identity if it is ever lost or stolen.
* **Database key backup** (`blink-kek-<instance>-<date>.json`): the backup of the key that protects every secret in the database. You need it to restore a database backup on new hardware.

1. Enter a **Passphrase** of at least 12 characters, confirm it, and select **Create recovery kit**.
2. **Download** both files, then select **I’ve saved both, continue**.
3. Prove the database key backup opens: select **Open the saved file** and enter the passphrase, or **Type its checksum**, then select **Continue**.
4. Do the same for the recovery file and select **Finish setup**.

Nobody can recover the passphrase

Blink keeps neither file, and nobody, IZT included, can recover the passphrase. Store the files offline, away from your database backups, and keep the passphrase somewhere else, such as your password manager. Without them, a lost server means reinstalling every Access agent.

## Activate the license

[Section titled “Activate the license”](#activate-the-license)

Sign in to the console and open **Instance** › **License**. Activate online with the activation code IZT sent you, or use the offline exchange if the server does not reach the internet. Use the DNS name you chose above as the hostname. The steps are in [Activate your license](/get-started/activate-your-license/), and renewal is covered in [Check and renew your license](/configure/license/).

Once the license is active, the server fetches the agent builds for your instance. You can see them under **Instance** › **License** › **Agent builds**.

## Next steps

[Section titled “Next steps”](#next-steps)

1. [Set up certificates](/install/certificates/) so browsers trust your Blink address.
2. [Back up the server](/install/back-up-and-restore/).
3. [Create an enrollment key](/install/enrollment-keys/) and [install the Access agent](/install/access-agent-windows/).

# Run the support tool

> What your customer downloads and runs for a one-off support session, on Windows and on a Mac.

For a one-off Support session, your customer downloads a small support tool from your Blink address and runs it. Nothing stays installed, and nothing has to be prepared on their computer beforehand. This page walks through what the customer sees, so you can talk them through it.

## How the customer gets the tool

[Section titled “How the customer gets the tool”](#how-the-customer-gets-the-tool)

1. In the console, open **Sessions**, select **Support code**, then **Create code**. Give the code to the customer by phone or by message. **Copy join link** copies the address of the join page.
2. The customer opens your Blink address in a browser, for example `https://yourname.onblink.cloud`. The join page is right at the root of the address (and also at `/join`).
3. They type the code and select **Download the support tool**.
4. The page shows **Your download has started** with the next steps for their computer.

The join page detects the customer’s computer: a Mac gets the Mac app, everything else gets the Windows tool. The code length and whether it uses digits or letters depend on your server’s settings, so read the code out exactly as the console shows it.

Each code works once and expires on its own. If the code is wrong or has expired, the page says **That code was not found or has expired. Ask your technician for a new one.**

## On Windows

[Section titled “On Windows”](#on-windows)

1. Open the downloaded file. Its name starts with `blink-` and ends in `.exe`.
2. If Windows shows a warning, choose **More info**, then **Run anyway**.
3. Keep the window open while the technician works. Closing it ends the session.

While the session is live, a banner stays on the customer’s screen.

Need administrator rights?

The support tool starts with the customer’s own rights. If you need to work in an elevated program or install software, use **Run as admin** in the viewer. You can enter an administrator’s username and password or use the UAC prompt; either way the customer approves a Windows prompt at their computer.

## On a Mac

[Section titled “On a Mac”](#on-a-mac)

1. Open the downloaded app from the Downloads folder. Its name starts with `Blink-`. Safari unzips it automatically; in other browsers, double-click the zip first.
2. If macOS will not open it, go to **System Settings** › **Privacy & Security** and choose **Open Anyway**.
3. When macOS asks, allow **Screen Recording** and **Accessibility** for Blink. See [Allow Blink on a Mac](/install/mac-permissions/) for the details.
4. Blink shows in the menu bar while the session is live. Choose **End session** there to stop.

Do not rename the app

The app’s name tells Blink which session it belongs to. If the customer renames it, it asks for a code instead. If that code is refused, create a new one.

The Mac tool needs macOS 12.3 or later. It runs on Apple silicon and Intel Macs.

## Other devices

[Section titled “Other devices”](#other-devices)

On an iPad the join page says **Use a computer** and does not offer a download. Blink does not run on phones, tablets or Linux. See [Check supported systems](/install/supported-systems/).

## If the download does not start

[Section titled “If the download does not start”](#if-the-download-does-not-start)

| Message                                                                                                                                               | What to do                                                                                                         |
| ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Too many tries. Wait a few minutes, then enter the code again.**                                                                                    | Wait, then try again.                                                                                              |
| **The support tool is not available yet. Ask your technician for another way to connect.** (on a Mac: **The Mac support tool is not available yet…**) | Your server does not have that tool yet. An administrator can check **Instance** › **License** › **Agent builds**. |
| **The server could not check the code right now. Try again in a moment.**                                                                             | Wait a moment, then try again.                                                                                     |
| **Could not reach the server. Check your connection and try again.**                                                                                  | The customer’s browser cannot reach your Blink address.                                                            |
| **The download did not start. Enter the code again, or ask your technician for a new one.**                                                           | Try again; if it repeats, create a new code.                                                                       |

For more, see [Fix a Support code that does not work](/troubleshooting/support-code-not-working/).

# Check supported systems

> Which computers Blink runs on, what technicians need, and what the network has to allow.

Check this page before you roll Blink out, so nobody finds out mid-call that a computer is not supported.

## Computers you support

[Section titled “Computers you support”](#computers-you-support)

|                                                 | Support tool (one-off sessions) | Access agent (unattended) |
| ----------------------------------------------- | ------------------------------- | ------------------------- |
| **Windows** 10 or later, 64-bit (x64)           | Yes                             | Yes                       |
| **macOS** 12.3 or later, Apple silicon or Intel | Yes                             | Not available             |
| **Linux**                                       | No                              | No                        |
| **iPhone, iPad, Android, ChromeOS**             | No                              | No                        |

* **Support** is for a session with someone sitting at the computer: they enter a code on your Blink address and run the support tool. Nothing stays installed. See [Run the support tool](/install/support-tool/).
* **Access** is for computers you reach when nobody is there. The Access agent installs as a Windows service and stays connected. See [Install the Access agent on Windows](/install/access-agent-windows/).

Mac

On a Mac, Blink runs Support sessions only. The Mac needs two privacy permissions before you can see and control it: see [Allow Blink on a Mac](/install/mac-permissions/).

iPad, phones and Linux

An iPad that opens your Blink address is told to use a Mac or a Windows PC instead. There is no Blink app for phones, tablets or Linux.

Phone camera with Blink View

With the Blink View add-on, a customer can show you their phone camera during a session from the phone’s web browser, with no app to install. Use Safari on an iPhone or iPad, or Chrome on Android; other browsers may work. See [See the customer’s phone camera with Blink View](/use/blink-view/).

## Technicians

[Section titled “Technicians”](#technicians)

Technicians work in a web browser: they sign in to the console at your Blink address and view sessions in a browser tab. There is nothing to install on the technician’s computer.

## Your own server

[Section titled “Your own server”](#your-own-server)

On Blink Cloud, IZT runs the server and there is nothing to check here. On premises, Blink needs a dedicated server running Debian 13 (x64), from 2 vCPU, 4 GB of memory and 64 GB of SSD storage, plus space for recordings. See [Server requirements](/install/on-premises-server/#server-requirements).

## Network

[Section titled “Network”](#network)

Every Blink connection starts from the computer you support. Nothing needs to reach in to that computer, so you do not open any inbound ports at the customer’s site.

* **Required:** the computer reaches your Blink address over HTTPS (TCP port 443).
* **Recommended:** it can also reach the server’s media and relay ports, which gives the smoothest picture. When only HTTPS gets through, the Access agent and the support tool still relay their connection over port 443.

For Blink View, the customer’s phone must reach your Blink address over HTTPS from wherever it is, usually mobile data or a guest network. A server activated online creates Blink View codes over its existing connection to `build.blink.izt.app` (443/TCP), the same one it uses for online activation; there is nothing extra to open.

If you run your own server, the ports to open on the server side are listed in [Install Blink on your own server](/install/on-premises-server/#open-the-ports).

# Uninstall the Access agent

> Remove the Access agent from a Windows computer, and revoke or delete the device in the console.

Removing a computer from Blink has two sides: the agent on the computer, and the device record in the console. Do both.

## Remove the agent from the computer

[Section titled “Remove the agent from the computer”](#remove-the-agent-from-the-computer)

1. On the computer, open Command Prompt or PowerShell **as administrator**.

2. Run:

   ```bat
   "C:\ProgramData\Blink\blink-agent.exe" --uninstall
   ```

The agent stops and removes the **IZT Blink Agent** service, tells your server it was uninstalled, and deletes the computer’s device identity, so nothing left behind can restore unattended access. Blink’s Safe Mode registration is removed, and the Windows setting Blink changed so it could send `Ctrl+Alt+Del` is put back (unless someone has changed it since).

You can run the same command from your management tool. It exits with code `0` on success and `1` on failure.

In the console the device now shows the status **uninstalled**.

Note

If the computer cannot reach your server while you uninstall, the agent is still removed, but the server is not told. The device then simply shows **offline** until you delete it in the console.

## Revoke or delete the device in the console

[Section titled “Revoke or delete the device in the console”](#revoke-or-delete-the-device-in-the-console)

Open **Access**, select the device (see [Manage Access devices](/use/manage-devices/)), and use the **Danger zone** at the bottom of its details. You need the **Remove devices** permission:

* **Revoke** keeps the record but invalidates the device’s credential, drops its connection and ends its open sessions. No enrollment key brings it back; only **Un-revoke** does. Use this when a computer is lost or stolen.
* **Delete** removes the device record entirely. The installed agent can no longer connect. Use this once the agent is uninstalled, or to enroll the computer again from scratch.

Caution

Revoking or deleting a device in the console does not remove the agent from the computer. If the computer still exists, uninstall the agent there too.

## Enrolling the computer again later

[Section titled “Enrolling the computer again later”](#enrolling-the-computer-again-later)

A computer whose agent reported its uninstall can be enrolled again by installing the agent with a key for the same device group, or a key with no group. See [Install the Access agent on Windows](/install/access-agent-windows/). If the enrollment is refused, delete the old device in the console first, or (when the device still shows as enrolled) use a key that allows re-enrollment.

# Upgrade the server

> Move an on-premises Blink server to a new version with a short, clean restart.

This page is for on-premises servers. In the cloud, IZT upgrades the server for you.

The console and the join page are built into the server, so upgrading the server upgrades them too. Agents update separately: see [Keep agents up to date](/install/agent-updates/).

## Before you upgrade

[Section titled “Before you upgrade”](#before-you-upgrade)

1. [Back up the database and the data folder](/install/back-up-and-restore/).

2. Note the version of the image you run now, so you can tell the two apart. An image prints its version with:

   ```sh
   docker run --rm <blink-server-image> -version
   ```

Going back is not always possible

A new version may update the database when it starts. An older version can refuse to start on a database a newer one has updated. Keep the backup from before the upgrade until you are happy with the new version.

## Upgrade

[Section titled “Upgrade”](#upgrade)

1. Get the new server image version.

2. Stop the running container and give it time to stop cleanly:

   ```sh
   docker stop -t 45 blink
   ```

   During those seconds the server pauses live sessions and finishes the recordings in progress.

3. Remove the old container (keep the volume: do **not** use `docker rm -v`):

   ```sh
   docker rm blink
   ```

4. Start a new container from the new image with exactly the same volume, ports, database settings and options as before.

5. Wait until `docker ps` shows the container as `healthy` and the sign-in page loads, then sign in to the console.

A session that was live during the restart waits up to two minutes for the server to come back; if the server takes longer, the session ends. Access agents reconnect on their own.

## After the upgrade

[Section titled “After the upgrade”](#after-the-upgrade)

* Open **Instance** › **License** and check the license and **Agent builds** cards for warnings.
* Start a test session to confirm everything works.

# Troubleshooting

> Fix common IZT Blink problems, from Support codes and connections to video, sign-in and licensing.

Each page here starts from what you see, lists the likely causes, and walks you through the checks in order. Most problems are fixed with the first two or three steps. Every page ends with what to collect before you contact IZT.

## Sessions

[Section titled “Sessions”](#sessions)

* [Fix a Support code that does not work](/troubleshooting/support-code-not-working/): the join page or the support tool refuses the code, or says it expired.
* [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/): the support tool stays on **Connecting…**, or an Access device shows as offline.
* [Fix a black screen or missing video](/troubleshooting/black-screen/): the viewer opens but shows nothing, or the picture freezes.
* [Fix missing Mac permissions](/troubleshooting/mac-permissions/): you cannot see or control a Mac, or permissions stopped working after a new download.
* [Fix slow or choppy video](/troubleshooting/slow-video/): the picture lags, stutters or looks blurry.
* [Fix audio problems](/troubleshooting/audio/): no sound from the remote computer, or it sounds wrong.

## Viewer tools

[Section titled “Viewer tools”](#viewer-tools)

* [Fix failed file transfers](/troubleshooting/file-transfer/): files do not arrive in either direction.
* [Fix a terminal that will not open](/troubleshooting/terminal/): the **Terminal** button is missing, greyed out, or the terminal closes straight away.
* [Fix chat problems](/troubleshooting/chat/): the **Chat** button is missing or greyed out, a message is not sent, or a secret cannot be sent or revealed.
* [Fix Blink View problems](/troubleshooting/blink-view/): the customer’s code, camera or phone browser does not work, or the Blink View button is missing.

## Console and instance

[Section titled “Console and instance”](#console-and-instance)

* [Fix a browser certificate warning](/troubleshooting/certificate-warning/): your browser says the connection to your Blink address is not private.
* [Get back into the console](/troubleshooting/locked-out/): forgotten password, lost authenticator, locked or banned address.
* [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/): “not allowed from this network”, or an Access device blocked by IP rule.
* [Fix license expiry and renewal problems](/troubleshooting/license/): what an expired license stops, and how to renew.

## Getting help

[Section titled “Getting help”](#getting-help)

* [Collect logs for IZT support](/troubleshooting/collect-logs/): where Blink keeps its logs and what to send IZT.
* [Turn on diagnostic mode](/troubleshooting/diagnostic-mode/): record more detail from every session and device for a limited time.
* [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/): send your server’s logs and settings to IZT in one step and get a reference code.

Tip

Can’t find your problem here? Ask the AI assistant, or contact [IZT](https://izt.app) and [send diagnostics](/troubleshooting/send-diagnostics/).

# Fix a Blink agent that will not connect

> Get a Blink support tool or Access device connected when it stays on Connecting or shows as offline.

## Symptoms

[Section titled “Symptoms”](#symptoms)

* The Blink support tool on the customer’s computer stays on **Connecting…** and never gets to **Ready to connect**.
* In **Sessions**, the customer has run the tool but the session never connects.
* In **Access**, a device shows as **offline**.
* The support tool says **This copy of Blink belongs to another Blink server.** or **This version of Blink is out of date.**
* An Access install never shows up under **Access**, and `C:\ProgramData\Blink\install.log` says **This Blink plan’s device limit is reached. Ask your administrator.** or **This Blink plan does not include Access. Ask your administrator.**

The Blink support tool keeps trying to connect every few seconds until the customer cancels it, so a stuck **Connecting…** almost always means the computer cannot reach your Blink server.

## Likely causes

[Section titled “Likely causes”](#likely-causes)

* The computer has no internet access, or cannot look up your Blink address (DNS).
* A firewall blocks outgoing connections to your Blink address.
* A firewall or security product inspects HTTPS traffic and replaces the server’s certificate.
* The network only allows traffic through a web proxy.
* The tool was downloaded from a different Blink server, or before your server’s identity changed.
* Too many failed connections from that address, so your server has blocked it for a while.
* For an Access install: all Access devices in your plan are in use, or your plan does not include Access.
* The organization’s agent IP rule does not allow the device’s address (Access devices only).

## What Blink needs from the network

[Section titled “What Blink needs from the network”](#what-blink-needs-from-the-network)

The agent only makes **outgoing** connections. You never need to open incoming ports on the customer’s computer or the Access device.

* **The address agents connect to.** Agents connect to the host name in your license, not necessarily the address you type in your browser. An administrator can see it in **Instance** › **License** under **Agents connect to**, or in **Instance** › **Certificates** under **Agent connections**.
* **Outgoing HTTPS.** The computer needs to reach that host name over HTTPS (TCP 443, unless your license names another port).
* **Outgoing UDP, where possible.** Video and audio prefer UDP. When UDP is blocked, Blink relays the session instead, which works but can be slower.
* **No proxy.** The agent connects directly. It does not use a web proxy configured in Windows or in the browser.
* **No HTTPS inspection.** The agent accepts only your Blink server’s own identity. A firewall that decrypts and re-signs HTTPS traffic looks to the agent like a different server, so the agent refuses it. Exclude the agent address from HTTPS inspection.
* **The computer’s clock does not matter.** The agent does not check dates when it connects, so a wrong clock on the customer’s computer is not the cause. (The session log shows an **agent clock** offset for information only.)

### If you run your own Blink server

[Section titled “If you run your own Blink server”](#if-you-run-your-own-blink-server)

Your server’s firewall, and any router in front of it, must let these in. These are the default ports of the Blink server image; your installation may use different ones.

| Port                                      | Used for                                                          |
| ----------------------------------------- | ----------------------------------------------------------------- |
| TCP 443, or the port you publish HTTPS on | The console, the join page, agents, and relayed sessions over TLS |
| UDP and TCP 8071                          | Session video, audio, input and files                             |
| UDP 3478 and 2565, TCP 3478               | The built-in relay, for networks that block direct connections    |
| UDP 49152 to 51199                        | Relay ports, one per relayed connection                           |

**Instance** › **Security** › **TURN relay** shows the relay ports your server listens on.

## Check the connection

[Section titled “Check the connection”](#check-the-connection)

Run these checks on the customer’s computer or the Access device.

1. Ask the customer to open your Blink address in a browser on that computer. If the join page does not load, fix the internet connection first.

2. Find the agent address (see above). If it is a different host name from the one in the browser, check that one too.

3. On Windows, open PowerShell and run:

   ```powershell
   Test-NetConnection yourname.onblink.cloud -Port 443
   ```

   Use your agent host name. `TcpTestSucceeded : True` means the computer can reach it. A name resolution error points to DNS; a failed TCP test points to a firewall.

4. If the computer is on a company network with a firewall that inspects HTTPS, ask its administrator to exclude the agent host name from inspection.

5. If the network only allows web traffic through a proxy, ask its administrator to allow direct outgoing connections to the agent host name.

6. Try another network, for example a phone hotspot. If Blink connects there, the original network is blocking it.

## Check the download

[Section titled “Check the download”](#check-the-download)

1. If the tool says **This copy of Blink belongs to another Blink server.** or **This version of Blink is out of date.**, create a new code and have the customer download the tool again.
2. Support tools carry your server’s identity from the moment they are downloaded. If an administrator changed the identity key (**Instance** › **Identity**) since, older downloads cannot connect. A fresh download always works. Access devices pick up identity changes on their own.
3. If your Blink server was reinstalled as a new instance, existing agents belong to the old one and cannot connect. Support customers download again; Access devices need Blink installed again.

## Check for a ban

[Section titled “Check for a ban”](#check-for-a-ban)

Your server blocks an address for a while after repeated failed connections.

1. An administrator with the **Manage security settings** permission opens **Instance** › **Security** and looks at **Bans**.
2. If the computer’s public address is listed with the source **Support agents** or **Access devices**, click **Lift**.

## Check the agent IP rule

[Section titled “Check the agent IP rule”](#check-the-agent-ip-rule)

An organization can limit where its Access devices may connect from. Support tools are never affected.

1. In **Access**, a device outside the rule shows **blocked by IP rule** instead of **offline**. Hover over it to see the address and country it was refused from, and when.
2. An administrator with **View agent IP rules** switches to the device’s organization and opens **Organizations** › **Agent IP rules**.
3. Type the device’s public address in **Test an address against the saved rule** and click **Test**. **Refused** means the rule keeps the device out.
4. If the address is expected, someone with **Manage agent IP rules** adds it, or its country, to the rule. The device connects again on its next try.

See [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/) and [Restrict access by IP address and country](/configure/ip-and-country-rules/).

## Check an offline Access device

[Section titled “Check an offline Access device”](#check-an-offline-access-device)

1. On the device, open **Services** and check that **IZT Blink Agent** is running. Start it if it is stopped.
2. Run the network checks above on the device.
3. Read the end of `C:\ProgramData\Blink\service.log` as an administrator. Repeated connection failures there name the reason.
4. In **Access**, check the device’s status. An **uninstalled** device does not come back online by itself: enroll it again. A **revoked** device comes back only through **Un-revoke** (see [Revoke a device](/use/manage-devices/#revoke-a-device)). Both need a free Access device in your plan. A device marked **blocked by IP rule** is kept out by its organization’s agent IP rule (see [Check the agent IP rule](#check-the-agent-ip-rule)).

## Check an Access install your plan refused

[Section titled “Check an Access install your plan refused”](#check-an-access-install-your-plan-refused)

If an Access install exits with code `20` or `21`, the computer reached your Blink server, but the server refused to enroll it because of your plan. The message is printed to the console the install was started from and written to `C:\ProgramData\Blink\install.log`:

| Message                                                                | Exit code | What to do                                                                                                                                                                                                                                               |
| ---------------------------------------------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **This Blink plan’s device limit is reached. Ask your administrator.** | `20`      | Every Access device in your plan is in use. Revoke or delete a device you no longer manage (see [Manage Access devices](/use/manage-devices/)), or ask for more devices in your plan. See [Access devices](/configure/plans-and-limits/#access-devices). |
| **This Blink plan does not include Access. Ask your administrator.**   | `21`      | Your plan does not include **Unattended Access**. Ask for it to be added to your plan.                                                                                                                                                                   |

The install was rolled back, so nothing is left running on a computer that was not enrolled before. The agent does not try again by itself: once the cause is fixed, run the install again. See [Exit codes](/install/access-agent-windows/#exit-codes).

## See what the agent sees (Windows)

[Section titled “See what the agent sees (Windows)”](#see-what-the-agent-sees-windows)

On Windows you can watch the support tool’s log live while it tries to connect:

1. Ask the customer to close the support tool if it is open.

2. Open Command Prompt in the folder with the download, usually `cd %USERPROFILE%\Downloads`.

3. Start the tool with `--console`, using the exact file name:

   ```bat
   blink-xxxxxxxxxxxx.exe --console
   ```

   A console window shows each connection attempt and why it failed. Copy the lines that say `connect failed` for IZT.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) when the computer can reach the agent address but still does not connect. Send the agent host name, the computer’s public IP address, the time, and the `connect failed` lines or the device’s `service.log`. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix audio problems

> What to check when you hear nothing from the remote computer in a Blink session, or the sound is poor.

## What Blink audio is

[Section titled “What Blink audio is”](#what-blink-audio-is)

Blink carries the remote computer’s **system sound** to you: whatever the computer is playing through its default output, such as alerts, videos or a ringing phone app. It does not carry a microphone, and it does not send your sound to the customer. It is not a voice call.

## Symptoms

[Section titled “Symptoms”](#symptoms)

* The audio button in the viewer shows **Muted**, **No audio** or **Audio not allowed**.
* The button shows **Audio on**, but you hear nothing.
* The sound is thin, tinny or choppy.

## No sound at all

[Section titled “No sound at all”](#no-sound-at-all)

1. **Unmute.** Browsers do not allow pages to play sound on their own, so the viewer starts muted. Your first click or key press in the viewer unmutes it, unless you muted it yourself. Click the audio button to switch between **Audio on** and **Muted**. Your choice is remembered in this browser.
2. **Check that something is playing.** You only hear sound while the remote computer is actually playing something. Ask the customer to play a short sound.
3. **No audio.** The remote computer is not sending sound. The session details in **Sessions** show **Audio** under **Remote computer**. If it says **no**, Blink could not capture the computer’s sound when the session started, for example because it had no working output device. Ask the customer to check that their speakers or headphones work, then start a new session.
4. **Audio not allowed** (Mac only). The customer has not allowed **Screen & System Audio Recording**, which covers sound as well as the screen. See [Fix missing Mac permissions](/troubleshooting/mac-permissions/). Once it is allowed, sound starts after Blink restarts.
5. **Not included in your plan.** If the button is greyed out on **No audio** and its tooltip says **Not included in your plan: remote audio**, your plan does not include **Remote audio**. See [Understand your plan and its limits](/configure/plans-and-limits/#when-something-is-not-in-your-plan).
6. **Check your own side.** Make sure your computer’s volume is up, the browser tab is not muted, and your speakers or headset are the selected output.

If the customer changes their default sound output during the session (for example by plugging in a headset), Blink switches to the new device by itself.

## Thin, tinny or choppy sound

[Section titled “Thin, tinny or choppy sound”](#thin-tinny-or-choppy-sound)

1. On a weak connection, Blink lowers the audio quality along with the video, down to mono. Improving the connection improves the sound too. See [Fix slow or choppy video](/troubleshooting/slow-video/).
2. Some laptops apply sound “enhancements” to their built-in speakers that cut the low tones. Blink hears the sound as the computer processes it, so you hear the same thin sound. Turning off the enhancements in the customer’s Windows sound settings for that output device can help.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if the session details say **Audio: yes**, the customer can hear sound locally, and you still hear nothing with the audio button on **Audio on**. Send the session id and the session log. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix a black screen or missing video

> What to check when the Blink viewer opens but shows a black, frozen or missing picture of the remote computer.

## Symptoms

[Section titled “Symptoms”](#symptoms)

* The viewer opens, the session shows as connected, but the picture stays black.
* The picture freezes while the customer is doing something, often when Windows asks for permission.
* The video is dimmed and a notice says **Reconnecting…** or **Customer reconnecting…**.
* On a Mac, a card says **The customer has not allowed screen sharing yet**.

## Likely causes

[Section titled “Likely causes”](#likely-causes)

* The connection to the server or to the customer’s computer dropped, and the viewer is waiting for it to come back.
* On a Mac, the customer has not allowed Screen Recording.
* On Windows, the customer is looking at a UAC prompt or the lock screen, which a session that is not running as administrator cannot capture.
* The network lets the session start but blocks the video itself.
* The computer’s graphics driver has trouble with hardware video encoding.

## Check the viewer first

[Section titled “Check the viewer first”](#check-the-viewer-first)

1. Look for a notice over the video. **Lost connection to the server. Trying again in N s.** means your own connection dropped; **Lost connection to the customer’s computer. Waiting up to 2 minutes for it to come back.** means theirs did. The picture returns by itself when the connection is back.
2. Look at the status strip along the bottom of the viewer. If the frame rate stays at `0 fps` while the session is connected, no video is arriving. Go on with the checks below.
3. If the customer has more than one monitor, switch to another monitor in the viewer to see whether only one screen is affected.
4. Reload the viewer page. If it says **This page is out of date**, click **Reload**.

## A Mac shows nothing

[Section titled “A Mac shows nothing”](#a-mac-shows-nothing)

macOS blocks screen capture until the customer allows Blink under **Screen & System Audio Recording**. The viewer shows the steps to read out to the customer, and **Ask the customer again** opens Blink’s permission window on their Mac. See [Fix missing Mac permissions](/troubleshooting/mac-permissions/).

## Windows freezes on a UAC prompt or the lock screen

[Section titled “Windows freezes on a UAC prompt or the lock screen”](#windows-freezes-on-a-uac-prompt-or-the-lock-screen)

Windows shows UAC prompts and the lock screen on a separate, protected desktop. A Blink session running as the signed-in user cannot capture it or click on it, so your picture stops changing until the prompt is gone.

1. Ask the customer to answer the prompt themselves.
2. To work through prompts yourself, click **Run as admin** in the viewer, enter an administrator’s user name and password and click **Elevate** (or click **Use UAC prompt** to have the customer approve it with their own administrator account). The customer approves one Windows prompt. From then on, Windows shows UAC prompts on the normal desktop for the rest of the session, so you can see and answer them. Blink puts the Windows setting back when the session ends.

In Access sessions Blink already runs with full rights, so it can show the lock screen and sign-in screen. Use the **Ctrl+Alt+Del** button in the viewer to reach the sign-in screen.

## The network blocks the video

[Section titled “The network blocks the video”](#the-network-blocks-the-video)

A session can connect (the customer’s tool shows it is connected, you can see the session in **Sessions**) while the video itself cannot get through. Blink then keeps trying to reconnect.

1. Try from another network on your side, for example a phone hotspot. If the picture appears, your network is blocking the video.
2. Check the network on the customer’s side as described in [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).
3. If you run your own Blink server, make sure the session and relay ports listed on that page are open, and that **Hand out TURN servers to agents and viewers** is on in **Instance** › **Security** › **TURN relay**.

## Graphics driver problems (Windows)

[Section titled “Graphics driver problems (Windows)”](#graphics-driver-problems-windows)

Blink uses the computer’s hardware video encoder when there is one. If the hardware encoder fails, stalls or refuses to start, Blink switches that screen to software encoding on its own and tries the hardware encoder again later. You normally see at most a short pause.

You can see which encoder a session uses: in **Sessions**, open the session and look at **Encoder** under **Remote computer**. `openh264` means software encoding; `mf` (Windows) or `vt` (Mac) means the hardware encoder.

If the video still stays black or garbled on one Windows computer, start a session with hardware encoding switched off:

1. End the current session and create a new Support code. The customer downloads the tool again.

2. The customer opens Command Prompt in their Downloads folder and starts the new download with:

   ```bat
   blink-xxxxxxxxxxxx.exe --encoder openh264
   ```

   using the exact file name.

3. If the picture now works, the computer’s graphics driver is the likely cause. Updating the graphics driver usually fixes it for later sessions.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if the picture stays black on a connected session after these checks. Send the session id, the remote computer’s Windows or macOS version, and the session log. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix Blink View problems

> What to check when the Blink View button is missing, the customer's code or link does not work, or their phone camera does not start.

Blink View lets the customer show you their phone camera from a web page on the phone. When something goes wrong, start from what you or the customer sees and work through the matching section. For how Blink View works, see [See the customer’s phone camera with Blink View](/use/blink-view/) and [Blink View on the customer’s phone](/use/blink-view-phone/).

## The Blink View button is missing

[Section titled “The Blink View button is missing”](#the-blink-view-button-is-missing)

The **Blink View** button in the viewer’s toolbar only shows when all of these are true:

* **Your license includes Blink View.** Blink View is an add-on. If your license does not include it, contact [IZT](https://izt.app). If the add-on is removed while you are in a session, creating a code says **Blink View is not included in your plan**.
* **Your role allows it.** In Support sessions you need **Blink View (support)**, in Access sessions **Blink View (access)**. The starter **Technician** and **Admin** roles include them. So do roles with **All Support permissions**, **All Access permissions** or **All permissions**. Custom roles that list permissions one by one do not, until an administrator adds the permission in **Roles**. See [Roles and permissions](/configure/roles/).
* **The session is still running.** The button disappears once the session has ended.

You do not need the Blink View permission to watch a camera another technician accepted: everyone in the session sees it.

## The code does not work

[Section titled “The code does not work”](#the-code-does-not-work)

The customer types the code on `view.blink.izt.app`. The page answers:

| Message                                                                          | What to do                                                                                                                                                                              |
| -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **That code didn’t work. Check it with your technician.**                        | Check the six digits with the customer. A code works once and lasts 10 minutes, and a cancelled code stops working at once. If it has expired or was used, click **Create code** again. |
| **Too many tries. Please wait a minute and try again.** (or a number of minutes) | Too many wrong codes were typed. Wait the time shown, then type the code again carefully.                                                                                               |
| **Blink View is not reachable right now. Please try again in a moment.**         | Wait a moment and try again, or create a new code. If it keeps failing, contact [IZT](https://izt.app).                                                                                 |

If the customer scanned the QR code or opened a link, the page on the phone can show:

* **That link didn’t work**: the link was already used, was cancelled or has expired. Create a new code and send the new link or QR code.
* **Too many tries**: wait a few minutes, then open the link again.

If your server was activated with a license file, there is no 6-digit code at all: the panel shows **Scan the QR code** with **Copy link**. Give the customer the QR code or send them the link instead.

A session can have at most 3 codes waiting at once. Creating a fourth says **This session already has 3 codes waiting. Cancel one first.** Click **Cancel code** on one you no longer need.

## Online and offline activation

[Section titled “Online and offline activation”](#online-and-offline-activation)

Whether customers get a 6-digit code or a direct link depends on how your license was activated. Check the **Activation** row on **Instance** › **License**:

* **Online** · activated over the internet; Blink View uses 6-digit codes
* **Offline** · activated with a license file; Blink View uses direct links

Activating or renewing the license online later switches the server to 6-digit codes. See [Check and renew your license](/configure/license/).

On a server activated online, creating a code needs the same outbound access as online activation: the server must reach `build.blink.izt.app` on 443/TCP (see [Activate your license](/get-started/activate-your-license/#activate-online)). When it cannot, the panel says **Blink View service unreachable** and offers **Use a direct link instead**. The direct link works the same way as on an offline server. It is offered for about 10 minutes after the failure; after that, **Use a direct link instead** answers **A direct link is only offered while the Blink View service is unreachable**, and you create a code again.

## The phone shows a certificate warning

[Section titled “The phone shows a certificate warning”](#the-phone-shows-a-certificate-warning)

Whether the customer types a code or scans a QR code, the phone always ends up on a page at your Blink address. If that address does not have a publicly trusted certificate, the phone’s browser shows a warning such as “Your connection is not private”. The Blink View panel warns you about this when it shows the QR code:

**The phone may show a certificate warning: this server’s certificate is not publicly trusted. Set up Let’s Encrypt under Console › Instance › Certificates.**

Phones never trust Blink’s built-in certificate. Give your Blink address a certificate from Let’s Encrypt, or upload one from a public certificate authority. A certificate from your own company CA does not help, because customers’ phones do not trust it. See [Fix a browser certificate warning](/troubleshooting/certificate-warning/) and [HTTPS certificates](/configure/certificates/).

The phone usually uses mobile data or a guest network, so your Blink address must also be reachable from the internet over HTTPS, not only from your office network.

## The camera does not start

[Section titled “The camera does not start”](#the-camera-does-not-start)

### Camera access is off

[Section titled “Camera access is off”](#camera-access-is-off)

If the customer refused the camera, or their browser blocks it, the phone shows **Camera access is off** with steps for their browser, and **Try again** and **Reload page** buttons. The steps are:

* **Safari on iPhone or iPad:** tap the “aA” button at the edge of the address bar. Tap Website Settings, then set Camera to Allow. Reload the page.
* **Other browsers on iPhone or iPad:** open the Settings app and find the browser in the list of apps. Turn on Camera. Come back and reload the page.
* **Firefox on Android:** tap the lock icon next to the address. Set Camera to Allowed. Reload the page.
* **Chrome and other browsers on Android:** tap the icon to the left of the address. Tap Permissions, then turn on Camera. Reload the page. If Camera stays off, allow it for the browser in the phone’s Settings › Apps.

### Other messages on the phone

[Section titled “Other messages on the phone”](#other-messages-on-the-phone)

| Message                                  | What to do                                                                                       |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------ |
| **Your camera is busy**                  | Another app is using the camera. Close other apps that use the camera, then tap **Try again**.   |
| **No camera found**                      | The device has no camera the page can use. Use another phone.                                    |
| **This browser can’t share your camera** | Open the link in Safari on an iPhone or iPad, or in Chrome on Android.                           |
| **Can’t reach the server**               | The phone cannot reach your Blink address. Check the phone’s connection, then tap **Try again**. |
| **This page is out of date**             | Tap **Reload**.                                                                                  |

## The phone waits and nothing happens

[Section titled “The phone waits and nothing happens”](#the-phone-waits-and-nothing-happens)

After the customer enters the code, the phone shows **Waiting for your technician** until a technician accepts it. The camera stays off until then.

* A prompt such as **iPhone, Safari wants to share its camera** appears in the viewer for technicians in the session who have the Blink View permission. Click **Accept**. A dot on the **Blink View** button also shows that a phone is waiting.
* Someone must answer within 2 minutes. After that the phone shows **No answer from your technician**, and you need a new code.
* If a technician clicked **Deny**, the phone shows **Your technician declined**. Create a new code if it was a mistake.
* Only one phone camera can be live in a session at a time. If one already is, Blink says **A phone camera is already live in this session**. End it first.

## Send QR to computer is missing or fails

[Section titled “Send QR to computer is missing or fails”](#send-qr-to-computer-is-missing-or-fails)

**Send QR to computer** shows the QR code in a window on the customer’s computer, so they can scan it with their phone.

* It is only offered in **Support sessions**. In Access sessions, give the customer the code or QR code yourself.
* It needs a current support tool. If the button is missing in a Support session, or Blink says **The customer’s Blink cannot show a QR code**, the customer runs an older support tool: create a new Support code and have them download the tool again.
* **Confirm the machine’s identity first.** means you have not confirmed the computer yet. Click **Confirm and take control** on the **Is this your customer’s computer?** card first.
* **The customer’s computer is not connected** means the support tool is not connected right now. Wait for it to reconnect.
* **The QR code could not be sent to the customer’s computer.** or **The QR code could not be shown**: try again, or read the code or QR code out to the customer instead.

If the customer closes the window, you see **The customer closed the QR code window**. Click **Send QR to computer** again to show it again.

## The picture freezes or says Paused

[Section titled “The picture freezes or says Paused”](#the-picture-freezes-or-says-paused)

* **The customer switched apps or locked the phone.** The phone’s camera stops while the page is not on screen, and you see a still picture. Ask the customer to go back to the browser page. The phone suggests **Keep your screen on while you share.** on phones where it cannot keep the screen on by itself.
* **Reconnecting…** on the camera tile means the connection to the phone dropped for a moment. Blink reconnects by itself. If the phone loses its connection for too long, the camera ends: the phone shows **Camera sharing ended** with **The connection was lost for too long.**, and you see **Blink View ended: the phone lost its connection**. Create a new code.
* For a slow or blurry picture, ask the customer to move to a better Wi-Fi or mobile signal.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if Blink View keeps failing after these checks. Send:

* the session code or session id and the time,
* the phone model and browser,
* the message the phone or the viewer showed. If the phone shows **Something went wrong**, include the **Reference** number shown under it.

See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix a block by an IP or country rule

> What to do when the console says it is not allowed from this network, or an Access device shows blocked by IP rule.

Blink has two IP and country rules. The **console rule** (**Instance** › **Security** › **IP and country rules**) decides where the console can be used from, for everyone including the Owner. Each organization’s **agent rule** (**Organizations** › **Agent IP rules**) decides where that organization’s Access devices may connect from. Support sessions and your customers’ join pages are never restricted. See [Restrict access by IP address and country](/configure/ip-and-country-rules/) for how the rules work.

Find what you see below.

## Sign-in says “Access to the console from this network is not allowed.”

[Section titled “Sign-in says “Access to the console from this network is not allowed.””](#sign-in-says-access-to-the-console-from-this-network-is-not-allowed)

The sign-in, setup or invite page shows **Access to the console from this network is not allowed.** Your address is outside the console rule. This is not a ban and not a wrong password: Blink refuses every console request from this network before it checks who you are, and the page does not say which addresses are allowed.

1. Connect from an allowed network, for example your company VPN or your office, and try again.
2. If you should be allowed from this network, ask an administrator who can still sign in to add your address or country under **Instance** › **Security** › **IP and country rules**.
3. If nobody can sign in, see [Nobody can sign in to the console](#nobody-can-sign-in-to-the-console).

## The console shows “Not available from this network”

[Section titled “The console shows “Not available from this network””](#the-console-shows-not-available-from-this-network)

If the rule changes while you are signed in, or you move to another network, the console shows a full page: **Not available from this network**, with **Your address** and **Country** (**Unknown** when the address has no country).

* **You stay signed in.** Connect from an allowed network, such as your company VPN, and click **Try again**.
* The page also checks again every 30 seconds on its own, and goes away once your address is allowed.
* **Sign out** ends your sign-in.

Send the address shown to an administrator if it should be allowed.

## The viewer or a terminal stops

[Section titled “The viewer or a terminal stops”](#the-viewer-or-a-terminal-stops)

* **The viewer** shows **Not available from this network** and the state **blocked by IP rule**: **The console’s IP rule does not allow this network.** It does not keep retrying. Once you are on an allowed network and the console works again, the viewer window starts again by itself.
* **A terminal** shows **Disconnected: the console’s IP rule does not allow this network. The terminal keeps running on the device for 2 minutes.** Move to an allowed network quickly: a terminal that no window attaches to for 2 minutes closes.

Saving a console rule closes the live viewers and terminals of everyone outside the new rule at once. The administrator who saved it was warned how many would close.

## An Access device shows “blocked by IP rule”

[Section titled “An Access device shows “blocked by IP rule””](#an-access-device-shows-blocked-by-ip-rule)

In **Access**, a device the organization’s agent rule refused shows the status **blocked by IP rule**. It counts as offline.

1. Hover over the pill. It says where the device connected from, which connection was refused (device connection, Access session or terminal) and when, for example **Refused by the agent IP rule from 203.0.113.7 (Germany), device connection, 5 min ago**.
2. To list every such device, choose **Blocked by IP rule** in the status filter. The **Offline** card shows how many are blocked.
3. Open the device’s details: the **IP rule** row repeats the refusal. It is cleared when the device next connects from an allowed address.
4. Decide whether the address is expected (the device moved, a new internet line, a VPN). If it is, an administrator with **Manage agent IP rules** switches to the device’s organization, opens **Organizations** › **Agent IP rules** and adds the address or country. Use **Test an address against the saved rule** with the address from step 1 to check the result.

An Access session or terminal that ends for this reason says **The device’s address is not allowed by the organization’s agent IP rule.**

The Owner gets the alert **Agent blocked by IP rule**, at most once per organization per day. See [Owner alerts and webhooks](/configure/alerts/).

## Enrollment or Install Access is refused

[Section titled “Enrollment or Install Access is refused”](#enrollment-or-install-access-is-refused)

* **Enrolling a device** with a key from an organization whose agent rule does not allow the computer’s address is refused. The installer exits with code 1 and logs **enrollment from this network is not allowed by the organization’s agent IP rule** (in `C:\ProgramData\Blink\install.log`, and in the console it was started from). Add the address or country to that organization’s agent rule, or enroll from an allowed network.
* **Install Access** in a Support session is refused when the customer’s computer is outside the organization’s agent rule, because the installed device could never connect: **The customer’s computer connects from *address*, which this organization’s agent IP rule does not allow, so Access installed there could not connect. Change the rule first.**

## A country entry does not match

[Section titled “A country entry does not match”](#a-country-entry-does-not-match)

* **Private and local addresses have no country.** An address such as `10.0.0.5` or `192.168.1.20`, or one the country database does not know, only matches IP range entries. The test then says **Refused: the address is not in the rule, and it has no country to match.**
* **The country may not be where you are.** A VPN, a mobile network or a satellite connection can appear in another country. Check what Blink sees: the rule card shows **You are connecting from** with your address and country.
* **IPv4 and IPv6.** A browser can reach the console over IPv4 one time and IPv6 the next, and a VPN can use a second network. A rule of IPv4 ranges only refuses your IPv6 address. Add both, or use a country entry, which covers both.

To check any address, an administrator types it in **Test an address against the saved rule** on the rule’s card and clicks **Test**. Leave the field empty to test your own address. The answer is **Allowed** or **Refused** with the reason, for example **Refused: neither the address nor its country is in the rule.**

## Nobody can sign in to the console

[Section titled “Nobody can sign in to the console”](#nobody-can-sign-in-to-the-console)

The console refuses to save a rule that does not allow the address of the person saving it, so a full lock-out is rare. It can still happen, for example when your office’s public address changes.

If anyone with **Manage security settings** can still sign in from an allowed network, they change or remove the rule under **Instance** › **Security** › **IP and country rules**.

**On your own server:** an administrator on the server host clears the console rule:

```sh
docker exec blink blink-server admin ip-rules clear-console -reason "Locked out"
```

Use your container’s name if it is not `blink`. The command prints whether the rule was cleared and how many entries it removed. The console can then be used from any address straight away. The clear is recorded in the activity log as **Cleared the console IP rule**, with your reason, and raises the Owner alert **Console IP rule cleared**. Sign in and set a new rule that includes your own address.

**On Blink Cloud:** contact [IZT](https://izt.app) with your Blink address.

An organization’s agent rule never locks you out of the console: an administrator can always change it under **Organizations** › **Agent IP rules**.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if you use Blink Cloud and nobody can sign in, or if an address is refused although the rule’s test says **Allowed**. Send your Blink address, the address and country shown, and the time. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix a browser certificate warning

> Why your browser warns that the connection to your Blink address is not private, and how to give Blink a trusted certificate.

## Symptoms

[Section titled “Symptoms”](#symptoms)

Your browser, or your customer’s, shows a warning such as “Your connection is not private” or “Warning: Potential Security Risk Ahead” when opening the Blink console or join page.

## Why it happens

[Section titled “Why it happens”](#why-it-happens)

Every Blink server has a **built-in certificate**. Browsers do not trust it, because no public certificate authority issued it. Blink serves it:

* when you open Blink by its **IP address** instead of a host name, and
* for any host name that has no trusted certificate yet.

If your license includes Blink View, a customer’s phone can show the same warning, because the page the phone opens is served from your Blink address. The Blink View panel in the viewer warns you when your certificate is not publicly trusted. See [Fix Blink View problems](/troubleshooting/blink-view/#the-phone-shows-a-certificate-warning).

Once a host name has a trusted certificate from Let’s Encrypt or one you uploaded, browsers stop warning for that name.

Note

Certificates only affect browsers. Blink agents (the support tool and Access devices) check your server’s own identity instead, and never use these certificates. Changing a certificate cannot break agent connections.

## If you use Blink Cloud

[Section titled “If you use Blink Cloud”](#if-you-use-blink-cloud)

Blink Cloud issues and renews the certificates for your Blink address for you. **Instance** › **Certificates** shows **Host names and certificates** with the names it manages. Make sure you open the address exactly as IZT gave it to you, for example `https://yourname.onblink.cloud`. If the warning appears on that address, contact IZT.

## If you run your own Blink server

[Section titled “If you run your own Blink server”](#if-you-run-your-own-blink-server)

You need the **Certificates** permission on the instance to do this.

### Find out which certificate a name gets

[Section titled “Find out which certificate a name gets”](#find-out-which-certificate-a-name-gets)

1. Open **Instance** › **Certificates**.
2. **Served names** lists each host name and the certificate it gets right now: **Let’s Encrypt**, **Uploaded** or **Built-in**. If it says **All names use the built-in certificate.**, no trusted certificate is set up yet.
3. Check the note next to a name: for example **Let’s Encrypt pending**, **Retrying at …**, or that a certificate has expired.

### Get a free certificate from Let’s Encrypt

[Section titled “Get a free certificate from Let’s Encrypt”](#get-a-free-certificate-from-lets-encrypt)

Before you start:

* Your host name must be a real DNS name (no IP address, no wildcard) that resolves to your Blink server.
* Let’s Encrypt must reach your server on **TCP port 443** from the internet. If your server listens on another port, forward TCP 443 to it. The page warns you when this is needed.

Then:

1. In **Instance** › **Certificates**, under **Let’s Encrypt**, tick **Use Let’s Encrypt**.
2. Enter your host names under **Domains**, one per line.
3. Optionally enter an **Email**.
4. Under **Directory**, choose **Production**. **Staging** is for testing only: its certificates are not trusted by browsers either.
5. Click **Save**. Blink requests the certificate and renews it automatically. To ask again straight away, click **Issue now** next to the domain.

Each domain gets at most 4 attempts per hour. If a request fails, fix the cause (usually DNS or port 443) and wait for the retry time shown.

### Or upload your own certificate

[Section titled “Or upload your own certificate”](#or-upload-your-own-certificate)

1. In **Instance** › **Certificates**, under **Uploaded certificates**, click **Upload certificate**.
2. Paste or choose the **Certificate chain**: the server certificate first, then its intermediates.
3. Paste or choose the **Private key**, unencrypted. Use an RSA key of 2048 bits or more, or an ECDSA P-256 or P-384 key.
4. Click **Upload**. The certificate must name at least one DNS host name. A certificate from your own company CA is accepted, and shows as **Private CA**: only computers that trust that CA stop warning.

### Locked out after a certificate change

[Section titled “Locked out after a certificate change”](#locked-out-after-a-certificate-change)

If a certificate change stops you from opening the console, the **Built-in certificate** card lists addresses that always work. Open one of them, accept the browser warning once, and fix the certificate settings. To be sure you reached your own server, compare the SHA-256 fingerprint your browser shows with the **Fingerprint** on that card, which you can note down in advance.

## Should I click through the warning?

[Section titled “Should I click through the warning?”](#should-i-click-through-the-warning)

Only when you know why it appears and have checked the fingerprint, for example during first setup by IP address. Never tell customers to click through a warning on the join page: set up a trusted certificate instead.

Passkeys also need a trusted connection: they only work when you open the console on its host name over HTTPS.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if Let’s Encrypt keeps failing while DNS and port 443 are correct, or if you use Blink Cloud and see a warning on your Blink address. Send the host name and the message shown in **Served names**.

# Fix chat problems

> What to check when the Chat button is missing or greyed out, a message is not sent, or a secret message cannot be sent or revealed.

Chat lets you write to the person at the remote computer, in sessions and before you connect to an Access device. See [Chat with the customer](/use/chat/) for how it works.

## The Chat button is missing

[Section titled “The Chat button is missing”](#the-chat-button-is-missing)

* **Your plan** must include **Chat**. Check the list on **Instance** › **License**, or ask someone who can see the license. See [Understand your plan and its limits](/configure/plans-and-limits/).
* **Your role** needs **Chat (support)** for Support sessions and **Chat (access)** for Access devices. The starter **Technician** and **Admin** roles have both, **Viewer** has neither, and custom roles get them only when an administrator adds them (or through **All Support permissions**, **All Access permissions** or **All permissions**). See [Roles and permissions](/configure/roles/).

## The Chat button is greyed out

[Section titled “The Chat button is greyed out”](#the-chat-button-is-greyed-out)

Hover over the button to see why.

| Message                                                                                                | What to do                                                                                                                  |
| ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
| **No user signed in**                                                                                  | Nobody is signed in on the Access device, so there is nobody to chat with. Connect instead, or wait until someone signs in. |
| **Device offline**                                                                                     | See [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).                                        |
| **Device revoked**                                                                                     | The device was revoked. See [Manage Access devices](/use/manage-devices/).                                                  |
| **Update the agent to chat with this device** or **This agent version has no chat. Update the agent.** | The device runs an agent without chat. See [Keep agents up to date](/install/agent-updates/).                               |

**Screen locked: messages show after the unlock** is not an error: you can write, and the user sees your messages once they unlock the computer.

## A message is not sent

[Section titled “A message is not sent”](#a-message-is-not-sent)

A message that did not go out is marked **Not sent** with the reason. **Retry** sends it again; **Remove** drops it.

| Message                                                               | What to do                                                                                                                                                                                                                       |
| --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Not sent: the connection dropped.**                                 | Your connection to the console dropped while sending. Send it again once the panel is connected.                                                                                                                                 |
| **The device is offline.** or **No user is signed in on the device.** | Messages to an Access device are not kept for later. Wait until the device is online with someone signed in.                                                                                                                     |
| **You are sending too fast. Wait a moment.**                          | Wait a few seconds, then send again.                                                                                                                                                                                             |
| **The message is too long.**                                          | A message can have up to 4,000 characters. Split it.                                                                                                                                                                             |
| **You have started too many chats this hour.**                        | Your administrator limits how many chats with devices’ users one person may start in an hour. Wait, or ask an administrator about **Chats started per hour** in [Security settings](/configure/security-settings/#fleet-limits). |
| **This chat has ended.**                                              | The session ended or the chat closed. In a chat before a session, your next message starts a new chat.                                                                                                                           |
| **You are not allowed to chat here.**                                 | Your role does not include chat for this session or device.                                                                                                                                                                      |
| **Not included in your plan.**                                        | Your plan does not include **Chat** (or **Secret messages**, for a secret).                                                                                                                                                      |

The panel’s header also says when the chat has closed, for example **The chat closed after an hour without messages** or **A different user signed in**. A chat with a device’s user closes after an hour without messages, and when another user signs in, so a new user never sees an earlier user’s conversation.

## The customer does not see the chat window

[Section titled “The customer does not see the chat window”](#the-customer-does-not-see-the-chat-window)

* **The chat window could not open on the customer’s screen**: Blink could not show the window on the remote computer. In an Access session, the user may have just signed out or switched users. Try again in a moment.
* **Reconnecting to the customer…**: the customer’s computer is reconnecting. In a Support session your messages wait for it; in an Access session they cannot be delivered until the device is back.
* The window may be behind other windows: it does not take the focus when a message arrives. Ask the customer to look for the flashing Blink button in the taskbar, or the Blink icon in the Mac’s menu bar. See [What your customer sees](/use/what-customers-see/#chat-with-your-technician).

## Secret messages

[Section titled “Secret messages”](#secret-messages)

| What you see                                                 | What to do                                                                                                                                         |
| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| No **Secret** toggle                                         | Your plan does not include **Secret messages**, or the remote computer runs an agent without them.                                                 |
| **Confirm the customer’s computer before sending a secret.** | In a Support session, confirm the computer first. See [Confirm it is the right computer](/use/support-sessions/#confirm-it-is-the-right-computer). |
| **Too many secrets are waiting to be viewed.**               | Wait until the customer opens or lets expire the secrets you already sent.                                                                         |
| **Pick a lifetime of 5, 15 or 60 minutes.**                  | Choose one of the lifetimes under **Expires after**.                                                                                               |
| **That secret is gone.**                                     | Someone already revealed it, or it expired. Ask the sender for a new one.                                                                          |
| **You cannot reveal your own secret.**                       | Only the other side can open a secret you sent.                                                                                                    |
| **Expired (the server restarted)**                           | Secrets waiting to be opened do not survive a restart of your Blink server. Send it again.                                                         |
| **Expired (the chat closed)**                                | The session ended or the chat closed before anyone opened it.                                                                                      |

Clicking **Reveal** on the customer’s screen with your remote mouse does nothing: only the customer can reveal a secret you sent them.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if chat fails with **The chat connection failed.** again after **Try again**, or with a message not listed here. Send the session id (or the device name), the time and the message. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Collect logs for IZT support

> Where Blink keeps session, device, agent and server logs, how to export them, and what to send IZT support.

Blink agents send their log to your Blink server while they are connected, so for most problems everything IZT needs is in the console. Local log files only matter when an agent cannot connect at all.

The quickest way

[Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/) sends your server’s logs and settings to IZT in one step and gives you a reference code. If the problem is hard to catch, [turn on diagnostic mode](/troubleshooting/diagnostic-mode/) first. Use the steps below for a single session or device log, or when an agent cannot connect.

## Session logs

[Section titled “Session logs”](#session-logs)

When your plan includes **Session timeline** (part of Blink Pro), every Support and Access session has its own log, with records from the agent on the remote computer and from your server. See [Understand your plan and its limits](/configure/plans-and-limits/#blink-core-and-blink-pro).

1. In the console, open **Sessions** and click the session.
2. Click **Full log**. The log opens in a new tab and keeps updating while the session is live.
3. Click **Reset filters** so nothing is hidden.
4. Click **.jsonl** to download the log for IZT. (**.txt** saves the records as the page shows them; **Copy** copies them.)

If **Full log** is missing and the session details say **Not included in your plan: Session timeline**, the session was started without a log, so there is none to collect. Otherwise **Full log** is missing because you need permission to view logs; ask an administrator.

### Capture more detail

[Section titled “Capture more detail”](#capture-more-detail)

If IZT asks for more detail, or a problem is hard to catch:

1. On the log page of a live session, click **Log levels**.
2. Set **Default level** to **Debug**, choose when it should **Revert after** (for example **1 hour**), and click **Apply**. It applies to a connected agent straight away.
3. Reproduce the problem, then download the log.

## Access device logs

[Section titled “Access device logs”](#access-device-logs)

Each Access device also has a log that runs across sessions.

1. Open **Access** and click the device.
2. Click **Log**. Tick **Include sessions** to see its session records in the same view.
3. Download it as above. **Log levels** works here too, and applies the next time the device connects if it is offline.

## When the agent cannot connect

[Section titled “When the agent cannot connect”](#when-the-agent-cannot-connect)

An agent that never reaches your server cannot send its log. Collect what is on the computer instead.

### Support tool on Windows

[Section titled “Support tool on Windows”](#support-tool-on-windows)

The support tool does not write a log file of its own. To see its log, start it from Command Prompt with `--console`:

```bat
cd %USERPROFILE%\Downloads
blink-xxxxxxxxxxxx.exe --console
```

Use the exact file name. A console window shows the log as the tool runs; copy the text for IZT. Add `--log-level debug` for more detail.

### Access device (Windows)

[Section titled “Access device (Windows)”](#access-device-windows)

Open these files as an administrator:

| File                               | Contents                                                          |
| ---------------------------------- | ----------------------------------------------------------------- |
| `C:\ProgramData\Blink\service.log` | The Access service: connections to your server, sessions, updates |
| `C:\ProgramData\Blink\update.log`  | Agent updates                                                     |
| `C:\ProgramData\Blink\install.log` | Installation and enrollment                                       |

Older entries are kept next to each file as `service.1.log`, `service.2.log` and so on.

### Crash files (Windows and Mac)

[Section titled “Crash files (Windows and Mac)”](#crash-files-windows-and-mac)

If Blink crashed, it keeps the last records in a `crash-*.log` file and sends them to the server the next time that part of Blink runs and connects. You find them in:

* Windows: `%LOCALAPPDATA%\Blink` of the user who ran Blink
* Mac: `~/Library/Application Support/Blink`

## Server logs (your own Blink server)

[Section titled “Server logs (your own Blink server)”](#server-logs-your-own-blink-server)

Your Blink server writes its own log to standard output, one record per line. With the container image, read it with your container tool, for example `docker logs <container name>`. The server’s records about a session are also in that session’s log in the console, so you rarely need the server log for a single session. [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/) includes the server’s records too.

On Blink Cloud, IZT has the server logs. Send the session id and the time instead.

## What to send IZT

[Section titled “What to send IZT”](#what-to-send-izt)

Contact [IZT](https://izt.app) with:

* The reference code from [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/), for example `SUP-8F3K2M7Q`, if you sent diagnostics.
* What happened, what you expected, and the steps to make it happen again.
* The **time** it happened, with your time zone.
* The **Session id** from the session’s details in **Sessions**, or the device name for an Access device.
* Any **ref** a message showed, for example **The server could not start the session (ref …)**. IZT matches it to the log.
* The **Instance** id from **Instance** › **License**.
* The `.jsonl` session or device log, or the local files above if the agent never connected.
* The agent version, shown on the log page as **agent v…** and in the session details as **Agent**.

# Turn on diagnostic mode

> Record more detail from every session and device on your Blink server for a limited time, so IZT support can find the cause of a problem.

Diagnostic mode turns up logging for your whole Blink server at once: every Support session, every Access device and the server itself. Use it when IZT support asks for it, or when a problem is hard to catch and you do not know in advance which session it will hit.

It always has an end time. You choose how long it runs, at most 7 days, and it turns itself off when that time is up.

To turn up logging for one session or one device only, use [Change an agent’s log levels](/configure/recordings-and-logs/#change-an-agents-log-levels) instead.

## What you need

[Section titled “What you need”](#what-you-need)

The **Diagnostic mode** permission. Instance owners have it. No starter role includes it, because it covers every organization on the server; anyone else needs an instance role that includes it, given for all organizations. See [Instance administration](/configure/roles/#instance-administration).

It is available on every plan.

## Turn it on

[Section titled “Turn it on”](#turn-it-on)

1. Open **Instance** › **Diagnostics**.

2. Choose the level:

   * **Debug**: more detail. Start here.
   * **Trace**: the most detail, and a lot more records. Use it when IZT asks for it.

3. Choose how long it runs: **24 hours**, **3 days** or **7 days**.

4. Select **Turn on**.

It applies straight away to every agent that is connected, and to every session and device that connects while it is on.

### Turn up some parts only (advanced)

[Section titled “Turn up some parts only (advanced)”](#turn-up-some-parts-only-advanced)

IZT may give you a component setting to paste into the overrides field, for example `capture=trace`. It sets those parts of Blink to their own level on top of the level you chose. Leave it empty unless IZT asks.

## While it is on

[Section titled “While it is on”](#while-it-is-on)

The **Diagnostics** tab shows the level, who turned it on, and the time left. It also shows how many log records your server stored in the last hour, so you can see how much extra it writes.

There is no banner in the console while diagnostic mode is on. Your team and your customers see no difference in sessions. The **Instance** › **Activity** log records when diagnostic mode is turned on, extended, turned off, and when it ends by itself.

Diagnostic mode never makes logging quieter. If a technician already turned up the level of one session or device by hand, that level still applies where it is more detailed, and it stays when diagnostic mode ends.

## Extend it or turn it off

[Section titled “Extend it or turn it off”](#extend-it-or-turn-it-off)

* **Extend** starts the time again from now, with the duration you choose. It can never run for more than 7 days from the moment you extend it.
* **Turn off** ends it at once. Connected agents go back to their normal level straight away.

When the time is up, diagnostic mode turns off by itself and connected agents go back to normal. A Support session that has lost its connection to your server at that moment keeps the detailed level until it reconnects or ends.

## How long the records are kept

[Section titled “How long the records are kept”](#how-long-the-records-are-kept)

Records written while diagnostic mode is on are kept as long as Info records: **30 days** by default, or your `-log-retention` setting on your own server. Normally Debug and Trace records are kept for only 3 days, so this keeps them available until you send them to IZT. Records written after diagnostic mode ends follow the normal rules. See [How long session logs are kept](/configure/recordings-and-logs/#how-long-session-logs-are-kept).

Caution

**Trace** can write a very large number of records on a busy server, and they take up storage for 30 days. Use the shortest duration that catches the problem, and turn it off once you have what you need.

## Then send the logs to IZT

[Section titled “Then send the logs to IZT”](#then-send-the-logs-to-izt)

1. Turn on diagnostic mode.
2. Reproduce the problem, or wait for it to happen. Note the time.
3. [Send diagnostics to IZT Support](/troubleshooting/send-diagnostics/) for the time it happened.
4. Turn diagnostic mode off.

# Fix failed file transfers

> What to check when files you send to a customer, or files they send you, fail or never arrive in a Blink session.

## How file transfer works

[Section titled “How file transfer works”](#how-file-transfer-works)

* **To the customer:** click **Send file** in the viewer toolbar, or drop files onto the remote screen. Files arrive in the customer’s **Downloads** folder, in a **Blink** subfolder. Blink checks every file after it arrives and only keeps it if it is complete and unchanged.
* **From the customer (Windows):** the customer clicks **Send file** on the Blink banner, or **Send file to technician…** in the Blink tray icon menu. The file goes to the technician who used the session most recently. It appears in the viewer’s transfer list as **received · accept to save**, and is only saved to your computer when you click **Accept**.

The transfer list in the viewer shows each file’s progress and, when one fails, the reason.

## The Send file button is missing

[Section titled “The Send file button is missing”](#the-send-file-button-is-missing)

1. Your role does not include file transfer for this session. Ask an administrator to check your role in **Roles**.
2. If the viewer shows **Is this your customer’s computer?**, nothing reaches the computer until you confirm it. Check the computer name and signed-in user with the customer, then click **Confirm and take control**.

## Files to the customer fail

[Section titled “Files to the customer fail”](#files-to-the-customer-fail)

Common reasons in the transfer list:

| Reason                                                           | What to do                                                            |
| ---------------------------------------------------------------- | --------------------------------------------------------------------- |
| **the customer is not connected**                                | Wait until the session is connected again, then send the file again.  |
| **too many transfers**                                           | Wait for the current transfers to finish.                             |
| **no answer from the server** or **no answer from the customer** | The connection dropped. Send the file again once the session is back. |
| **stopped by customer** or **cancelled by customer**             | The customer stopped it. Check with them.                             |
| **sha256 mismatch** or **verification failed**                   | The file did not arrive intact and was not kept. Send it again.       |

Also check:

1. The customer has enough free disk space for the file.
2. On a Mac, the first file may make macOS ask whether Blink can use the Downloads folder. The customer must allow it.
3. In an Access session, someone must be signed in to Windows: files go to the signed-in user’s Downloads folder. With nobody signed in, the transfer is refused.

## Files from the customer fail

[Section titled “Files from the customer fail”](#files-from-the-customer-fail)

| Reason                                                                      | What to do                                                                                                                                   |
| --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **no technician can receive files**                                         | No technician in the session has file transfer allowed, or nobody has the viewer open. Open the viewer, then ask the customer to send again. |
| **only 4 files at a time; accept or decline the others first**              | Click **Accept** or **Decline** on the files already waiting.                                                                                |
| **not enough room in the browser; accept or decline the other files first** | Same as above. Files waiting for **Accept** are held in your browser, up to 1 GiB in total.                                                  |
| **file too large for the browser (max 1 GiB)**                              | Files over 1 GiB cannot be received in the viewer. Ask the customer to split or compress the file, or share it another way.                  |
| **the transfer stalled**                                                    | Nothing arrived for a minute. Ask the customer to send it again.                                                                             |

Files that can run programs (such as `.exe`, `.msi`, `.ps1` or macro-enabled Office files) show a warning and a **Save anyway** button instead of **Accept**. Only save them if you expect the file.

Customers can send files to you from Windows computers. The Mac support tool does not have a **Send file** option.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if transfers fail with the same reason on a stable connection, or with a reason not listed here. Send the session id, the file size, the reason shown, and the session log. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix license expiry and renewal problems

> What happens when a Blink license expires, what keeps working during the grace period, and how to renew.

Your Blink instance runs on a license from IZT. It is activated once, online with an activation code or offline with a license file, and then renewed before it expires. You need to be an **instance owner** to activate or renew; anyone with the **View license** permission can see the license state and your plan.

## Symptoms

[Section titled “Symptoms”](#symptoms)

* A banner across the console says **The license has expired.** and counts down the days until new agent builds and updates stop.
* The banner says **The license and its 30-day grace are over: no new agent builds or updates. Agents keep connecting.**
* **Instance** › **License** shows the state **Expired, in grace**, **Lapsed**, **Not valid** or **Not activated**.
* The join page says **The support tool is not available yet.**
* A banner says more users or Access devices are in use than your plan allows, for example **12 users for 10 technician seats: new users are refused until you are under the limit.**
* A page shows **Not included in your plan:** followed by a feature, or a pill such as **Custom roles: not in your plan**.
* An action is refused with **Your plan does not include …**, or with a message that all technician seats or Access devices in your plan are in use.

## What still works

[Section titled “What still works”](#what-still-works)

| License state                                      | What happens                                                                                                                                                                                                                                                                                          |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Active**                                         | Everything works.                                                                                                                                                                                                                                                                                     |
| **Expired, in grace** (first 30 days after expiry) | Everything still works. The console shows a banner with the days left. Renew now.                                                                                                                                                                                                                     |
| **Lapsed** (after the 30-day grace)                | Everything in your plan keeps working: installed Access devices and downloaded support tools keep connecting, and Support sessions keep working. Blink no longer gets new agent versions, Access devices are not updated, and new enrollment installers cannot be built.                              |
| **Not activated** or **Not valid**                 | Nothing in the plan is available until the license is activated or renewed: Support codes, enrollment and new users are refused, and the console marks every feature as not in your plan. The server cannot fetch agents from IZT or build installers, so customers cannot download the support tool. |

A license problem never cuts off agents that are already connected or installed.

## Renew a license

[Section titled “Renew a license”](#renew-a-license)

### Your server reaches IZT online

[Section titled “Your server reaches IZT online”](#your-server-reaches-izt-online)

Blink renews by itself, starting when about a third of the license period is left, and keeps retrying. Under **Renews**, **Instance** › **License** shows the date automatic renewal starts, and below it the last attempt and its error, if there was one.

1. Open **Instance** › **License** and read the last attempt’s error.
2. Click **Renew now**.
3. If renewal keeps failing, check that the server can reach `license.blink.izt.app` and `build.blink.izt.app` on 443/TCP (firewall, proxy, DNS), then contact IZT with the error shown.

### Your server is offline

[Section titled “Your server is offline”](#your-server-is-offline)

Renewing offline is the same exchange as offline activation, without a code:

1. In **Instance** › **License**, check that **Hostname** shows your licensed host name, then under **Offline** click **Activation request** to download the request file.
2. On `license.blink.izt.app`, use the **Renew** page and upload the request. The portal returns a license file.
3. Back in **Instance** › **License**, click **License file** and choose the file to import it.

The request file is valid for 30 days after you download it. Your server’s clock must be correct: a request dated in the future is refused.

## Plan limits and missing features

[Section titled “Plan limits and missing features”](#plan-limits-and-missing-features)

These messages come from your plan, not from a license fault. See [Understand your plan and its limits](/configure/plans-and-limits/).

| Message                                                                                                                         | What to do                                                                                                                         |
| ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Your plan includes** *N* **technician seats and** *M* **are in use. Technician seats: ask your provider to raise the limit.** | Every user account takes a seat, pending invites included. Disable or delete a user you no longer need, or ask IZT for more seats. |
| **Your plan includes** *N* **Access devices and** *M* **are in use. Access devices: ask your provider to raise the limit.**     | Revoke or delete an Access device you no longer need, or ask IZT for more devices.                                                 |
| **Your plan does not include** *feature*. …                                                                                     | Ask IZT to add the feature to your plan.                                                                                           |
| **Not included in your plan:** *feature*                                                                                        | The page or control needs a feature your plan does not include. Ask IZT to add it.                                                 |

After IZT changes your plan, an instance owner selects **Renew now** on **Instance** › **License** to get the new license straight away. An offline server picks it up with the [offline renewal](#your-server-is-offline).

## Error messages

[Section titled “Error messages”](#error-messages)

| Message                                                                                                                      | What to do                                                                                                                              |
| ---------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **That activation code is not valid. Check it, or ask IZT for a new one.**                                                   | Check the code. It looks like `BLINK-XXXXX-XXXXX-XXXXX-XXXXX`. If it is right, ask IZT for a new one.                                   |
| **The build service refused the hostname: …**                                                                                | The host name does not match your license. Contact IZT.                                                                                 |
| **Confirm with a code from your authenticator first.**                                                                       | Enter your two-factor code when asked, then try again.                                                                                  |
| **The stored license is not valid for this instance**                                                                        | The license belongs to another instance, or was issued before your server’s identity key changed. Renew it; if that fails, contact IZT. |
| **The license service signs with a key this server does not know: the current license is kept. Update the server to renew.** | Install the current Blink server release, then renew.                                                                                   |

Check your server’s clock

A server clock that is far off can make a valid license look expired, or not yet valid. Keep the server’s time synchronised.

## Blink Cloud

[Section titled “Blink Cloud”](#blink-cloud)

On Blink Cloud the hostname is set for you and shows **Managed by Blink Cloud**, and renewal is automatic. If every page of your Blink address shows **This account is suspended**, contact IZT.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if renewal keeps failing, you need a new activation code, the license shows **Not valid**, or you want to change your plan or add technician seats or Access devices. Send the **Instance** id and the **License id** from **Instance** › **License** (use the copy button next to the instance id), and the error shown under the last attempt.

# Get back into the console

> Sign in to the Blink console again after a forgotten password, a lost authenticator, a lockout, a banned address or a network the IP rule does not allow.

Every Blink sign-in needs your password and a second factor: a passkey, or a 6-digit code from your authenticator app. Find the message you see below.

## “invalid email or password”

[Section titled ““invalid email or password””](#invalid-email-or-password)

1. Check the email address and type the password again. Watch for Caps Lock.
2. Blink has no “forgot password” link. Ask an **instance owner** to reset your sign-in (see below). They send you a link to choose a new password.
3. If you are sure the password is right, your account may be disabled. Blink gives the same message for a disabled account. Ask someone who manages users to check the **Users** page; a disabled account shows **disabled**, and **Enable** turns it back on.

## Your authenticator code is refused (“incorrect code”)

[Section titled “Your authenticator code is refused (“incorrect code”)”](#your-authenticator-code-is-refused-incorrect-code)

1. Wait for the next code and enter it. Each code works only once, so a code you already used is refused even if it is still on screen.
2. Check that your phone’s clock is set automatically. Codes are based on the time; Blink accepts the code before and after the current one, but not a phone clock that is minutes off.
3. Make sure you are using the Blink entry in your authenticator app, if you have several.

## You lost your phone or authenticator

[Section titled “You lost your phone or authenticator”](#you-lost-your-phone-or-authenticator)

1. On the **Two-factor code** step, enter one of your **recovery codes** instead of the 6-digit code. Each recovery code works once.
2. If you have a passkey, click **Use your passkey instead**.
3. Once you are in, open **Account** and click **New recovery codes** under **Two-factor authentication**. Your old codes stop working. To move to a new phone, have an instance owner reset your sign-in so you can set up two-factor again.
4. If you have no recovery codes and no passkey, ask an instance owner to reset your sign-in.

## Reset someone’s sign-in (instance owners)

[Section titled “Reset someone’s sign-in (instance owners)”](#reset-someones-sign-in-instance-owners)

1. Open **Users** and expand the person’s row.
2. Click **Reset sign-in** and confirm. Their password, two-factor and recovery codes are removed and they are signed out everywhere.
3. Copy the link from the **Sign-in reset** dialog and send it to them. It works once and expires; it is not shown again. If it gets lost, click **New invite link** on their row.
4. They open the link, choose a new password and set up two-factor again.

If the only instance owner is locked out and has no recovery codes or passkey, contact IZT.

## “too many failed sign-ins for this account from your address; try again later”

[Section titled ““too many failed sign-ins for this account from your address; try again later””](#too-many-failed-sign-ins-for-this-account-from-your-address-try-again-later)

Too many wrong passwords for this account from your network. By default, wait 15 minutes and try again with the right password. The lockout only applies to your address, so the account still works from elsewhere.

## “too many wrong codes for this account; try again later”

[Section titled ““too many wrong codes for this account; try again later””](#too-many-wrong-codes-for-this-account-try-again-later)

Too many wrong two-factor codes. By default, this locks the account on every network for 15 minutes. Wait, then sign in with a fresh code or a recovery code.

## “too many attempts; slow down”

[Section titled ““too many attempts; slow down””](#too-many-attempts-slow-down)

Too many sign-in attempts from your address in a short time, or your address was banned for a few minutes after repeated failures. Everyone behind the same office internet connection shares the address. Wait five minutes and try again.

## “this address is banned”

[Section titled ““this address is banned””](#this-address-is-banned)

An administrator banned your address or network. Every page of your Blink address refuses it until the ban ends or is lifted.

1. Ask an administrator who can still sign in to open **Instance** › **Security** › **Bans** and click **Lift** next to your address.
2. To keep a trusted network such as your office from being banned by the automatic limits, they can add it to the **Allowlist** on the same page.

The rate limits behind these messages can be changed under **Rate limits** on the same page.

## “Access to the console from this network is not allowed.”

[Section titled ““Access to the console from this network is not allowed.””](#access-to-the-console-from-this-network-is-not-allowed)

This is the console’s IP and country rule, not a ban. Your address, or its country, is not on the list of networks allowed to use the console. Signed-in users see the same text on a full page titled **Not available from this network**.

1. Connect from an allowed network, such as your company VPN or your office, and try again.
2. If you should be allowed from this network, ask an administrator who can still sign in to change **Instance** › **Security** › **IP and country rules**.
3. If nobody can sign in at all, see [Nobody can sign in to the console](/troubleshooting/blocked-by-ip-rule/#nobody-can-sign-in-to-the-console).

More on what a block looks like: [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/).

## “account unavailable”

[Section titled ““account unavailable””](#account-unavailable)

Your account has been disabled. Ask someone who manages users to check **Users** and click **Enable**.

## “sign-in session expired; start over”

[Section titled ““sign-in session expired; start over””](#sign-in-session-expired-start-over)

You took too long between the password and the code. Click **Start over** and sign in again.

## “No passkey of yours works at this address”

[Section titled ““No passkey of yours works at this address””](#no-passkey-of-yours-works-at-this-address)

Passkeys are tied to the host name you set them up on, and need a trusted HTTPS connection. Open the console on its usual host name, not an IP address, or enter a code instead. See [Fix a browser certificate warning](/troubleshooting/certificate-warning/).

The recovery kit does not unlock accounts

The recovery kit you saved during first setup (the **Recovery key** and the **Database key backup**) recovers your Blink server’s identity and its database key. It does not reset passwords or two-factor. Keep it offline and safe, but use the steps above for sign-in problems.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if no instance owner can sign in, or a sign-in error does not match this page. Send the message you see and the time.

# Fix missing Mac permissions

> Get Screen Recording and Accessibility working for Blink on a Mac, including after a new download stops them working.

macOS does not let any app see the screen or control the mouse and keyboard until the person at the Mac allows it. Blink needs two permissions, and only the customer can give them:

* **Screen & System Audio Recording**: so you can see the screen and hear the Mac’s sound.
* **Accessibility**: so your mouse and keyboard reach the Mac.

## Symptoms

[Section titled “Symptoms”](#symptoms)

In the viewer:

* A card says **The customer has not allowed screen sharing yet**, and the screen stays black.
* A card says **Screen Recording allowed. Waiting for Blink to restart**.
* A bar says **Your mouse and keyboard don’t reach the customer’s Mac yet.**
* The audio button shows **Audio not allowed**.

On the customer’s Mac, a Blink window says **Your technician needs permission to see your screen** (or **to control your screen**), with a row for each permission.

## Give the permissions

[Section titled “Give the permissions”](#give-the-permissions)

1. If Blink’s permission window is not on the customer’s screen, click **Ask the customer again** in the viewer (or **Ask again** on the bar).
2. Ask the customer to click **Open Settings** next to **Screen & System Audio Recording**. This opens **System Settings** › **Privacy & Security** › **Screen & System Audio Recording**.
3. Ask them to turn on **Blink**. macOS may ask for their password.
4. Screen Recording only takes effect after Blink restarts. Usually Blink restarts itself and rejoins the session, and its window also offers a **Restart Blink** button. If the window instead says to click **Quit & Reopen**, the customer clicks it when macOS asks. The viewer shows the screen once Blink is back.
5. Ask the customer to click **Open Settings** next to **Accessibility** and turn on **Blink** there too. This one works straight away.
6. The window shows **✓ Allowed** for each permission and **All set. Your technician can now help you.**, then closes by itself.

The window refreshes every second, so the customer does not need to close or reopen anything to see the new state.

## The switch is on, but it still says “Not allowed yet”

[Section titled “The switch is on, but it still says “Not allowed yet””](#the-switch-is-on-but-it-still-says-not-allowed-yet)

This usually happens after the customer runs a newer Blink download than the one they first allowed. macOS keeps the old permission for the old Blink, and the new one does not inherit it.

1. In **System Settings** › **Privacy & Security** › **Screen & System Audio Recording**, ask the customer to select **Blink**.
2. Remove it with the **−** button.
3. Do the same under **Accessibility** if Blink is listed there and control does not work.
4. Ask the customer to open Blink again and allow it when asked, or turn it on in the list again.

## Blink will not open on the Mac

[Section titled “Blink will not open on the Mac”](#blink-will-not-open-on-the-mac)

If macOS refuses to open the downloaded Blink app, ask the customer to go to **System Settings** › **Privacy & Security** and choose **Open Anyway**, then open Blink again. The join page shows the same steps.

## Files from you are not arriving

[Section titled “Files from you are not arriving”](#files-from-you-are-not-arriving)

The first time you send a file, macOS may ask the customer whether Blink can use their Downloads folder. They must allow it. Files arrive in **Downloads** › **Blink**. See [Fix failed file transfers](/troubleshooting/file-transfer/).

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if both permissions show **✓ Allowed** and the screen is still black, or if control still does not work. Send the session id, the Mac’s macOS version and the session log. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Send diagnostics to IZT Support

> Send IZT Support your Blink server's logs and settings in one step, see what you sent, and delete it from IZT.

When you contact IZT about a problem, you can send your Blink server’s logs and settings straight from the console. IZT Support gets everything it needs from one reference code, without any access to your server or your sessions.

IZT only ever receives what someone on your team sends. IZT cannot fetch anything from your server, and sending gives IZT no access to it.

## What you need

[Section titled “What you need”](#what-you-need)

The **Send diagnostics to IZT** permission. Instance owners have it. No starter role includes it, because one send can hold every organization’s logs; anyone else needs an instance role that includes it, given for all organizations. See [Instance administration](/configure/roles/#instance-administration).

It is available on every plan.

## What is included

[Section titled “What is included”](#what-is-included)

* **Your server’s settings**: Blink version, host names and time zone; your plan, its limits and expiry; certificate details (names, issuer, validity, how they were set up); network and connection settings; IP and country rules; sign-in policy; recording, log and diagnostic mode settings; and counts of organizations, users, devices and sessions.
* **Status**: license and renewal status, certificates, storage space, and which agent versions are in use.
* **Server log records** from the time you choose.
* **Sessions**: for each session in the time you choose, or that you pick, its details (organization, technician, device, times, agent version and operating system, how it connected, errors) and its whole log.
* **Access device logs**: the connection records of the devices involved, from the time you choose.

The logs contain **user names, email addresses, device names and IP addresses** as they are. IZT Support needs them to match your report to the right session. Nothing is masked.

## What is never included

[Section titled “What is never included”](#what-is-never-included)

* Recordings, screenshots or audio
* Chat messages
* Terminal transcripts
* Clipboard contents and transferred files
* Passwords, two-factor codes, tokens, license keys or private keys

Anything in a log that looks like a password, token or key is replaced with `[redacted]` before it is sent.

## Send diagnostics

[Section titled “Send diagnostics”](#send-diagnostics)

1. Select **Help** in the top bar, then **Send diagnostics to IZT**.

2. Choose what to include:

   * a time: **Last 24 hours**, **3 days**, **7 days**, or your own range of up to 7 days; and/or
   * specific sessions, picked from your session list (up to 200). Select **Load older** for older sessions, or paste a session’s id or a link to it (for example from its recording or log) to add any session on your server, in any organization.

   Server logs and settings are always included. Pick the time the problem happened; a shorter time makes a smaller file.

3. Check the estimated size and read the notice about what is sent.

4. Select **Send**.

The console shows the progress. When it is done, it shows the reference code, for example `SUP-8F3K2M7Q`. Copy it and give it to IZT Support with your description of the problem.

There is no size limit, so a large send can take a while. You can close the dialog and check on it under **Sent diagnostics**.

Tip

If diagnostic mode is off, the dialog suggests turning it on first. For the most detail: [turn on diagnostic mode](/troubleshooting/diagnostic-mode/), reproduce the problem, then send.

### Limits

[Section titled “Limits”](#limits)

* One send at a time.
* Up to 10 sends in 24 hours.

## See what you sent

[Section titled “See what you sent”](#see-what-you-sent)

Select **Help** › **Sent diagnostics**. The list shows each send with its reference code, when and by whom it was sent, what it included, its size, its status and when IZT deletes it.

Every send, download and deletion is also recorded in **Instance** › **Activity**.

## How long IZT keeps it

[Section titled “How long IZT keeps it”](#how-long-izt-keeps-it)

IZT deletes everything you sent **7 days** after it arrives. You can delete it sooner:

1. Open **Help** › **Sent diagnostics**.
2. Select **Delete from IZT** on the send.

Deleting a send that is still in progress stops it. If IZT may already have received all of it, the send stays listed and offers **Delete from IZT**, so you can make sure nothing is kept. A failed send can offer **Delete from IZT** for the same reason; other failed and cancelled sends offer **Remove**, which only clears them from the list. If your server cannot reach IZT at that moment, try again later; the send stays listed until the deletion goes through.

## If your server cannot reach IZT

[Section titled “If your server cannot reach IZT”](#if-your-server-cannot-reach-izt)

Sending uses the same connection to IZT as online license activation: your server must reach `build.blink.izt.app` on 443/TCP. If your server is not activated, or it cannot reach IZT (for example, it is activated offline on a closed network), download the file instead:

1. Open **Send diagnostics to IZT** and choose what to include, as above.
2. Select **Download bundle**. A file named like `blink-diagnostics-SUP-8F3K2M7Q.tar.gz` downloads. Start the download within 10 minutes.
3. Send the file to IZT Support however suits you, with the reference code in its name.

Downloads appear under **Sent diagnostics** too: **Download link issued** until the download starts, **Downloading** while it runs, then **Downloaded**. A link that was not used within its 10 minutes shows **Link not used**; select **Remove** to clear it and download again.

The file holds exactly what a send would. IZT Support attaches it to your server’s records, and it is deleted after 7 days like a send.

## If the send fails

[Section titled “If the send fails”](#if-the-send-fails)

The **Sent diagnostics** list shows why. The common causes:

* **Your server cannot reach IZT.** Check that your firewall allows `build.blink.izt.app` on 443/TCP, or use **Download bundle**.
* **Too many sends.** Wait, or download the file instead. IZT also accepts only a few sends from one server in a few minutes, and two at a time.
* **IZT is busy or short of space.** The send fails with “IZT is not available right now”. Try again later.
* **The connection is too slow.** IZT ends a send that moves less than 64 KiB in 5 minutes. Use **Download bundle** on very slow links.
* **License problem.** A revoked or unknown license cannot send. See [Fix license expiry and renewal problems](/troubleshooting/license/).
* **The server restarted** while it was sending. Send again.

# Fix slow or choppy video

> Make a Blink session smoother when the picture lags, stutters or looks blurry.

## Symptoms

[Section titled “Symptoms”](#symptoms)

* Your clicks and typing show up late on the remote screen.
* The picture stutters, freezes for a moment, or jumps.
* The picture is blurry or in black and white.

## Read the status strip

[Section titled “Read the status strip”](#read-the-status-strip)

The strip along the bottom of the viewer shows live numbers for the screen you are watching:

* the frame rate (`fps`) and the video bit rate,
* download and upload speed (`↓` and `↑`),
* `ms rtt`: the round trip time of the connection. Lower is better.
* `+N ms buffer`: extra delay Blink adds to smooth over network hiccups. It grows after a hiccup and shrinks after a quiet minute.
* `N lost`: packets lost on the way. It only shows when some are lost.

A high round trip time points to a slow or distant connection. A growing **lost** count points to a congested or unreliable network, often Wi-Fi.

## Pick a quality setting

[Section titled “Pick a quality setting”](#pick-a-quality-setting)

The quality menu in the viewer toolbar has four settings. Every session starts on **auto**, and a manual choice lasts until you close the viewer.

| Setting      | What you get                                                                                                        |
| ------------ | ------------------------------------------------------------------------------------------------------------------- |
| **auto**     | Blink adjusts frame rate, sharpness and colour to the connection as it changes.                                     |
| **low**      | 15 frames per second at half resolution, in black and white. Easiest on a poor connection, and text stays readable. |
| **standard** | 30 frames per second at full resolution.                                                                            |
| **high**     | Up to 60 frames per second (or the monitor’s refresh rate) at full resolution. Needs a fast connection.             |

If the picture turns grey or blurry on **auto**, that is Blink saving bandwidth on a weak connection. Choose **standard** or **high** only when the connection can carry it.

## Check the network

[Section titled “Check the network”](#check-the-network)

1. Close other heavy traffic on both sides: large downloads, cloud backups, video calls.
2. Ask the customer to move closer to their Wi-Fi router or use a cable.
3. Each monitor you watch, in the viewer or in pop-out windows, is a separate video stream. Watch only the screens you need.
4. Try your side from another network. If it is better there, your network is the bottleneck.

## Direct or relayed

[Section titled “Direct or relayed”](#direct-or-relayed)

Blink connects video directly when the networks allow it. When a firewall blocks the direct route, for example a network that blocks UDP, Blink relays the session instead. A relayed session works, but it usually adds delay.

* **Blink Cloud:** relaying is handled for you. If sessions with one customer are always slow, ask them whether their network blocks outgoing UDP traffic.
* **Your own Blink server:** make sure the session and relay ports are open on the server (see [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/)), so sessions do not have to fall back to relaying over TLS.

## Check the remote computer

[Section titled “Check the remote computer”](#check-the-remote-computer)

1. In **Sessions**, open the session and look at **Encoder** under **Remote computer**. `openh264` means the computer is encoding video in software, which uses more of its processor and can slow things down on an older computer. See [Fix a black screen or missing video](/troubleshooting/black-screen/) for graphics driver advice.
2. Ask the customer to close programs that keep the processor busy.

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if sessions stay slow on a good connection on both sides. Send the session id, the time, and the numbers from the status strip. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix a Support code that does not work

> What to do when the join page or the Blink support tool refuses a Support code or says it has expired.

## Symptoms

[Section titled “Symptoms”](#symptoms)

Your customer enters the code you gave them and sees one of these:

* On the join page: **That code was not found or has expired. Ask your technician for a new one.**
* On the join page: **Too many tries. Wait a few minutes, then enter the code again.**
* On the join page: **The support tool is not available yet. Ask your technician for another way to connect.** (on a Mac: **The Mac support tool is not available yet.**)
* On the join page: **Could not reach the server. Check your connection and try again.**
* In the Blink support tool on their computer: **Code expired or not valid. Try again** or **Code expired or not valid. Enter a new code**.
* In the support tool: **The server could not start the session (ref …). Enter a new code**.

## How Support codes work

[Section titled “How Support codes work”](#how-support-codes-work)

* A code works **once**. As soon as the support tool connects with it, the code is used up.
* An unused code **expires 15 minutes** after you create it. The session’s details in **Sessions** show when it expires (**Expires**) and whether the customer has downloaded the tool yet (**Downloaded**).
* The support tool the customer downloads is tied to that code. It has to be started before the code expires.
* The code format is an instance setting: digits, or letters and digits, in a fixed length. Customers can type it with or without spaces and dashes, in upper or lower case. The letters O, I and L are read as 0, 1 and 1, so a misread character still works.

## Check the code

[Section titled “Check the code”](#check-the-code)

1. In the console, open **Sessions** and find the session. If the session has ended or its code has expired, click **Support code** to create a new one and give the customer the new code.
2. Read the code to the customer again, group by group, exactly as the console shows it. If the code contains letters, ask them to read it back to you.
3. Make sure the customer is on **your** Blink address. Codes only work on the Blink address that created them. Use **Copy join link** on the new code to send them the right page.
4. If the customer opened the page on an iPad, it shows **Use a computer**: Support works on a Mac or a Windows PC only.

## “Too many tries”

[Section titled ““Too many tries””](#too-many-tries)

Blink blocks an address for a few minutes after repeated wrong codes, to stop people guessing codes. Everyone behind the same office internet connection shares that address.

1. Ask the customer to wait five minutes, then enter the code once, carefully.
2. If it keeps happening, an administrator with the **Manage security settings** permission can open **Instance** › **Security**, check **Bans** for the customer’s address and click **Lift**. The ban source shows as **Join codes**.

## The support tool refuses the code

[Section titled “The support tool refuses the code”](#the-support-tool-refuses-the-code)

The support tool reads its code from its own file name (`blink-….exe` on Windows, `Blink-….app` on a Mac). If it cannot use it, it opens a window that asks **Enter the code from your technician**. The tool accepts three codes per start, counting the one in its file name.

1. If it says **Code expired or not valid**, the code was used, expired, or mistyped. Create a new code and have the customer type it into the same window. If the window has closed, have them download the tool again from the join page with the new code.
2. If the customer renamed the downloaded file, the tool cannot find its code in the name and asks for it. That is fine: they can type the code.
3. If it says **The server could not start the session (ref …)**, the code is used up. Note the ref, create a new code and have the customer enter it. If it happens again, contact IZT with the ref.
4. If it says **This version of Blink is out of date. Download Blink again from your technician.**, or **This copy of Blink belongs to another Blink server. Download Blink again from your technician.**, the customer started an old download. Create a new code and have them download the tool again.
5. If it says **Blink is already running.**, a support tool is already open on that computer. Use that one, or close it and start again.

## “The support tool is not available yet”

[Section titled ““The support tool is not available yet””](#the-support-tool-is-not-available-yet)

Your Blink server has no support tool to hand out for that kind of computer. This happens when the instance is not activated yet, or before the server has fetched the support tool. An administrator should check **Instance** › **License**. See [Fix license expiry and renewal problems](/troubleshooting/license/). If the license is active and the message stays, contact IZT.

## “Could not reach the server”

[Section titled ““Could not reach the server””](#could-not-reach-the-server)

The customer’s browser could not load your Blink address. Ask them to reload the page. If the join page itself does not load, the problem is their internet connection or a firewall in front of it. See [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if a fresh code is refused on the first try, or **The server could not start the session** keeps coming back. Send the session id from the session’s details in **Sessions**, the ref the tool showed, and the time it happened. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Fix a terminal that will not open

> What to check when the Blink Terminal button is missing or greyed out, or a remote terminal closes on its own.

A Blink terminal opens a command window on the remote computer (PowerShell or Command Prompt on Windows, a login shell on a Mac) in a separate browser window. When your plan includes **Terminal history**, everything shown in a terminal is recorded.

## The Terminal button is missing

[Section titled “The Terminal button is missing”](#the-terminal-button-is-missing)

The **Terminal** button only shows when your role allows terminals. Granting a whole area such as Support or Access does not include the terminal: a role must name **Terminal (support)** or **Terminal (access)** itself. Only the **Owner** role has them by default; the starter **Admin**, **Technician** and **Viewer** roles do not.

Ask an administrator to add the permission to your role in **Roles**. The viewer says so too: **You don’t have permission to open a terminal here. Ask an administrator to grant Terminal in Roles.**

Your plan must also include **Remote terminal**. If it does not, the button does not appear for anyone, whatever their role. See [Understand your plan and its limits](/configure/plans-and-limits/#when-something-is-not-in-your-plan).

## The Terminal button is greyed out

[Section titled “The Terminal button is greyed out”](#the-terminal-button-is-greyed-out)

Hover over the button to see why. Common reasons:

| Message                                                                                   | What to do                                                                                                                              |
| ----------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Confirm the computer first**                                                            | In a Support session, confirm the computer first: click **Confirm and take control** on the **Is this your customer’s computer?** card. |
| **Waiting for the customer’s computer**                                                   | The customer’s computer is not connected right now. Wait for it to reconnect.                                                           |
| **The customer’s Blink app is too old for a terminal; they can download the current one** | Create a new Support code and have the customer download the tool again.                                                                |
| **Agent update required for terminal**                                                    | The Access device runs an older Blink. It updates itself when a newer release is available.                                             |
| **Device is offline**                                                                     | See [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).                                                    |
| **Device is restarting**                                                                  | Wait until the device is back online.                                                                                                   |

## The terminal window does not appear

[Section titled “The terminal window does not appear”](#the-terminal-window-does-not-appear)

Terminals open in a new browser window or tab. If your browser blocks pop-ups for your Blink address, nothing opens. Allow pop-ups for your Blink address and try again.

## The terminal shows an error or closes

[Section titled “The terminal shows an error or closes”](#the-terminal-shows-an-error-or-closes)

The terminal window says why it could not open, or its last line says why it closed. The most common messages:

| Message                                                                                                                      | Meaning                                                                                                                                                                                                                                                        |
| ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Elevate the session to run as administrator** or **The session isn’t elevated.**                                           | You chose to run as administrator in a Support session that is not elevated. Click **Run as admin** in the viewer first, or open the terminal as the customer.                                                                                                 |
| **The device already has 3 terminals open.**                                                                                 | A computer can have at most 3 terminals open. Close one first.                                                                                                                                                                                                 |
| **You have 10 terminals open**                                                                                               | Close some of your terminals.                                                                                                                                                                                                                                  |
| **Nobody is signed in on that session any more.** or **That user signed out.**                                               | In an Access session you chose to run as a user who is no longer signed in. Pick another choice in **Open as…**.                                                                                                                                               |
| **The device couldn’t connect to the server for the terminal.**                                                              | The remote computer reached Blink for the session but not for the terminal. Check its network as for any connection problem.                                                                                                                                   |
| **The device didn’t respond. It may be offline or blocked from reaching the server.**                                        | As above.                                                                                                                                                                                                                                                      |
| **The shell couldn’t be started.** or **The user’s profile couldn’t be loaded.**                                             | The remote computer could not start the chosen shell. Try another shell, or run as another account.                                                                                                                                                            |
| **Closed after 30 minutes without input.**                                                                                   | Terminals close after 30 minutes with nothing typed. Open a new one.                                                                                                                                                                                           |
| **Closed because no window was attached for 2 minutes.**                                                                     | The terminal window was closed for too long. Open a new one.                                                                                                                                                                                                   |
| **The customer closed the command window.**                                                                                  | The customer clicked **Close command windows** on their Blink banner or menu. Ask before opening another one.                                                                                                                                                  |
| **Too many terminals opened; try again in N s.**                                                                             | Wait and try again.                                                                                                                                                                                                                                            |
| **The remote terminal is not included in your plan.**                                                                        | Your plan does not include **Remote terminal**. Ask IZT about changing your plan.                                                                                                                                                                              |
| **Disconnected: the console’s IP rule does not allow this network. The terminal keeps running on the device for 2 minutes.** | Your address is outside the console’s IP and country rule. Move to an allowed network, such as your company VPN: a terminal that no window attaches to for 2 minutes closes. See [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/). |
| **The device’s address is not allowed by the organization’s agent IP rule.**                                                 | The Access device’s organization limits where its devices may connect from, and the device is outside it. See [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/#an-access-device-shows-blocked-by-ip-rule).                          |

## When to contact IZT

[Section titled “When to contact IZT”](#when-to-contact-izt)

Contact [IZT](https://izt.app) if a terminal fails with **The terminal closed because of an error.** or another message not listed here. Send the session id (or the device name), the time and the message. See [Collect logs for IZT support](/troubleshooting/collect-logs/).

# Use Blink

> Day-to-day work in IZT Blink: support sessions, Access devices, the viewer and its tools, recordings and session history.

This section covers the work you do in Blink every day, from giving a customer a code to reviewing what happened in a session last week.

Blink has two ways to reach a computer:

* **Support** is attended help. You create a one-time code, the customer types it on the join page, runs the small support tool, and you see their screen. Support works on Windows PCs and Macs. Nothing stays installed when the session ends.
* **Access** is unattended. The Blink agent is installed on a Windows computer you manage, and you connect to it from the console whenever it is online, without anyone at the keyboard.

Both kinds of session open in the same viewer. With Blink Pro, every screen you view and every terminal is recorded, and every session keeps a timeline and log. See [Understand your plan and its limits](/configure/plans-and-limits/).

## Sessions

[Section titled “Sessions”](#sessions)

* [Run a support session](/use/support-sessions/): create a code, confirm the computer, work, and end the session.
* [What your customer sees](/use/what-customers-see/): the join page, the support tool, the banner, the chat window and how the customer ends a session, on Windows and Mac.
* [Blink View on the customer’s phone](/use/blink-view-phone/): what the customer does on their phone when you ask to see through its camera.
* [Connect to an Access device](/use/access-sessions/): start an unattended session, and what viewing and controlling mean.
* [Chat with the customer](/use/chat/): messages and view-once secret messages in Support and Access sessions, and with an Access device’s user before you connect.

## The viewer and its tools

[Section titled “The viewer and its tools”](#the-viewer-and-its-tools)

* [Use the viewer](/use/viewer/): the toolbar, multiple monitors, quality, audio and reconnecting.
* [Control the computer](/use/control-and-clipboard/): mouse and keyboard, Type text, Ctrl+Alt+Del and the shared clipboard.
* [Transfer files](/use/transfer-files/): send files to the computer and accept files from it.
* [Run as administrator](/use/run-as-administrator/): relaunch Blink with administrator rights on a Windows computer.
* [Reboot and Safe Mode](/use/reboot-and-safe-mode/): restart an Access device, or start it in Safe Mode with Networking.
* [Work in Backstage](/use/backstage/): a hidden desktop on an Access device that the signed-in user cannot see.
* [Open a remote terminal](/use/remote-terminal/): PowerShell, Command Prompt or the Mac login shell, recorded when your plan includes terminal history.
* [See the customer’s phone camera with Blink View](/use/blink-view/): the customer shows you their phone camera from a web page, no app.

## After the session

[Section titled “After the session”](#after-the-session)

* [Play and manage recordings](/use/recordings/): the session player, downloads and deleting recordings.
* [Review session history](/use/session-history/): find past sessions, read the timeline and open the log.

## Devices

[Section titled “Devices”](#devices)

* [Manage Access devices](/use/manage-devices/): rename, tag and group devices, push agent updates, revoke and delete.

## Reference

[Section titled “Reference”](#reference)

* [Keyboard shortcuts](/use/keyboard-shortcuts/): keys in the viewer, the terminal and the session player.

What you can do in each of these pages depends on your role and your plan. If a button described here is missing for you, ask an administrator to check your role. Roles are covered in [Roles and permissions](/configure/roles/) and groups in [Limit access with groups](/configure/groups/).

# Connect to an Access device

> Start an unattended session on a Windows computer that has the Blink agent installed, and understand viewing versus controlling.

Access devices are Windows computers with the Blink agent installed and enrolled into your organization. You can connect to them whenever they are online, with nobody at the keyboard. To add devices, see [Install the Access agent on Windows](/install/access-agent-windows/), or install Access from a support session (see [Run a support session](/use/support-sessions/#turn-a-support-session-into-an-access-device)).

## Find a device

[Section titled “Find a device”](#find-a-device)

1. In the console, open **Access**.
2. Use the search box to find a device by name, host name, OS, agent version or tag, or filter by status (**Online**, **Offline**, **Revoked**) and group.

Each row shows the device’s OS, agent version, groups and connection. The **Connection** column shows whether the device is online now or when it was last seen, and whether a technician is connected.

## Start a session

[Section titled “Start a session”](#start-a-session)

1. Select **View** on the device’s row (or open the device and select **View**).
2. The viewer opens in a new tab and connects.

If the console asks you to confirm it is you, switch back to the console tab, confirm, and the viewer continues.

**View** is greyed out while the device is offline or revoked. If the device went offline between the list refreshing and your click, the console says **That device is offline right now.**

Note

An Access session connects silently. The person signed in on the device sees no banner and no tray icon, and is not asked to approve. Only a chat message you send shows on their screen, in a chat window. Make sure your use of Access matches your agreements with the people whose computers you manage. When your plan includes **Session recording** and **Session timeline**, Access sessions are recorded and logged like any other session.

## Chat with the signed-in user

[Section titled “Chat with the signed-in user”](#chat-with-the-signed-in-user)

You can chat with the person signed in on the device, in the session with the viewer’s **Chat** button, or before you connect with the chat button on the **Access** page, for example to ask whether now is a good time. A chat started before the session carries on into it when you select **Connect** in the chat panel. Chat needs **Chat (access)**. See [Chat with the customer](/use/chat/#chat-before-you-connect).

## Viewing and controlling

[Section titled “Viewing and controlling”](#viewing-and-controlling)

What you can do in a session depends on your role:

* **Connect to devices** lets you start a session.
* **Join access sessions (any)** lets you open a session someone else started. On its own, it is view only.
* **Control (access)** lets you use the mouse and keyboard and Type text.
* **Clipboard (access)** and **File transfer (access)** add the shared clipboard and file transfer.

If you can watch but not control, the viewer toolbar shows **View only** and the status strip at the bottom reads **view only**. Your mouse and keyboard stay on your own computer.

To join a session that is already running, open **Sessions**, find the device, and select **View**. Several technicians can be in the same session.

## Tools in an Access session

[Section titled “Tools in an Access session”](#tools-in-an-access-session)

On top of the tools every session has (see [Use the viewer](/use/viewer/)), Access sessions add these, each when your role and your plan allow it:

* **Ctrl+Alt+Del**: sends the key combination to the device, for the lock or sign-in screen. Typing Ctrl+Alt+Del on your own keyboard does not reach Windows sign-in; use this button. It is not shown in Backstage.
* **Power**: reboot the device, or reboot it into Safe Mode with Networking. See [Reboot and Safe Mode](/use/reboot-and-safe-mode/).
* **Terminal**: a PowerShell or Command Prompt on the device, recorded when your plan includes **Terminal history**. See [Open a remote terminal](/use/remote-terminal/).
* **Backstage**: a hidden desktop the signed-in user cannot see. You start it from the **Access** page; in a Backstage session the toolbar button switches between the hidden desktop and the live screen. See [Work in Backstage](/use/backstage/).
* **Blink View**: someone with the device can show you their phone camera. Give them the code or link yourself: in Access sessions the QR code cannot be sent to the computer. Needs **Blink View (access)**. See [See the customer’s phone camera with Blink View](/use/blink-view/).

## End the session

[Section titled “End the session”](#end-the-session)

* In the viewer, select **End**, then **End session**. Every technician viewing the device is disconnected and, if the session is recorded, the recording is finalized.
* Or in **Sessions**, select **End** on the session’s row.

The device stays enrolled and online, ready for the next session.

# Work in Backstage

> Use Backstage, a hidden desktop on an Access device, to work in the background without interrupting the signed-in user.

Backstage gives you a separate, hidden desktop on a Windows Access device. Programs you start there run alongside the user’s own desktop, but the user never sees them. Use it to check services, read event logs or run tools while the user keeps working undisturbed.

Note

Backstage is in beta. Some programs may not draw or respond to input as reliably on the hidden desktop as on the normal one.

## Start a Backstage session

[Section titled “Start a Backstage session”](#start-a-backstage-session)

1. In the console, open **Access**.
2. On the device’s row, select the **Backstage** icon (the crossed-out eye), or open the device and select **Backstage**.

The viewer opens on the hidden desktop and the toolbar shows **Backstage**. Your role needs the **Backstage** permission.

Inside an Access session that already has Backstage, the toolbar’s **Backstage** button switches to the hidden desktop, and **Exit Backstage** returns you to the live screen.

## The Backstage desktop

[Section titled “The Backstage desktop”](#the-backstage-desktop)

The hidden desktop has its own taskbar and Start menu. The Start menu pins common technician tools at the top:

* Command Prompt
* PowerShell
* File Explorer
* Task Manager
* Registry Editor
* Services
* Device Manager
* Event Viewer

Below them it lists the Start menu shortcuts installed on the computer.

## Who the programs run as

[Section titled “Who the programs run as”](#who-the-programs-run-as)

By default, programs in Backstage run as the user signed in on the device, with that user’s rights.

With the **Backstage as SYSTEM** permission, programs run as SYSTEM instead, with full control of the computer. Hover the **Backstage** button in the device’s details to see which applies to you. A Backstage session started this way can only be joined by technicians who also have **Backstage as SYSTEM**. Like the terminal, **Backstage as SYSTEM** is only in a role that names it explicitly; the Owner role has it.

## What the user sees

[Section titled “What the user sees”](#what-the-user-sees)

Nothing. Access sessions show no banner or tray icon, and the Backstage desktop is never shown on the device’s screen.

When your plan includes **Session recording**, Backstage sessions are recorded like any other session. They are marked **backstage** in **Sessions** and in the device’s session history. In the session player the hidden desktop appears as its own **Backstage** track.

## Tips

[Section titled “Tips”](#tips)

* **Ctrl+Alt+Del** is not available in Backstage. Exit Backstage to use it on the live screen.
* After a reboot with automatic reconnect on, the new session opens in Backstage again, unless the device came back in Safe Mode.

# See the customer's phone camera with Blink View

> Give the customer a code or a QR code, accept their phone, and see through its camera in the viewer during a Support or Access session.

Blink View lets you see through the customer’s phone camera during a session, for example to look at a router’s lights, a cable or a label on the back of a printer. The customer opens a web page on their phone: there is no app to install. Blink View shares the phone’s camera only, never its microphone or its screen, and nothing streams until you accept the phone.

Blink View works in Support sessions and in Access sessions. To share this with the customer, send them [Blink View on the customer’s phone](/use/blink-view-phone/).

## Before you start

[Section titled “Before you start”](#before-you-start)

* **Your license includes Blink View.** Blink View is an add-on to your license. Without it the button does not appear, or creating a code shows **Blink View is not included in your plan**.
* **Your role allows it.** You need **Blink View (support)** for Support sessions and **Blink View (access)** for Access sessions (see [Roles and permissions](/configure/roles/)). Without the permission, the **Blink View** button is not in your toolbar.
* **The phone can reach your Blink address over HTTPS.** The camera page on the phone is served from your own Blink address, so the customer’s phone needs to reach it, usually over the internet. If your server uses a certificate that phones do not trust, the customer sees a certificate warning first; a Let’s Encrypt or uploaded certificate avoids that (see [HTTPS certificates](/configure/certificates/)).

The **Blink View** button disappears once the session has ended.

## Create a code

[Section titled “Create a code”](#create-a-code)

1. In the viewer toolbar, select **Blink View** (the camera icon). The panel says what Blink View does.
2. Select **Create code**.
3. Read the code to the customer. The panel shows: “Ask the customer to open **view\.blink.izt.app** on their phone and enter” followed by the code, written as `123 456`, and a QR code under “or scan this with the phone’s camera:”.

The customer can either open view\.blink.izt.app, type the 6 digits and tap **Continue**, or scan the QR code with the phone’s camera. Scanning opens the same page with the code already filled in; they tap **Continue** once.

About codes:

* A code lasts 10 minutes. The panel counts down with **Expires in**.
* A code works for one phone, once. If it expired or was used, create a new one.
* A session can have up to 3 codes waiting at once. A fourth shows **This session already has 3 codes waiting. Cancel one first.**
* A code stays in the panel until it is used, cancelled or expires. If more codes are waiting in the session, the panel shows the newest one and notes how many older codes are still open.
* **Cancel code** withdraws the code shown in the panel.

How the customer uses the page on their phone is covered in [Blink View on the customer’s phone](/use/blink-view-phone/).

## Online and offline instances

[Section titled “Online and offline instances”](#online-and-offline-instances)

How the customer reaches Blink View depends on how your Blink license was activated. **Instance** › **License** shows it in the **Activation** row (see [Check and renew your license](/configure/license/)):

* **Online** (activated over the internet): Blink View uses 6-digit codes on view\.blink.izt.app, as described above, plus a QR code.
* **Offline** (activated with a license file): there is no 6-digit code. The panel shows **Scan the QR code** with a QR code that opens your Blink address directly, and **Copy link**. Have the customer scan the QR code, or copy the link and send it to their phone, for example by text message. Only the technician who created it sees the QR code and the link; other technicians in the session see “The QR code is shown to the technician who created it.”

Activating or renewing the license online later switches the instance to codes.

On an online instance, Blink creates codes over the same outbound connection it uses for online activation, so your server needs outbound access to `build.blink.izt.app` on port 443. If that service cannot be reached, the panel shows **Blink View service unreachable** and offers **Use a direct link instead**, which gives you a QR code and **Copy link** as on an offline instance. The direct link is offered for about 10 minutes after the failure; outside that time, asking for one shows **A direct link is only offered while the Blink View service is unreachable**.

## Send the QR code to the customer’s computer

[Section titled “Send the QR code to the customer’s computer”](#send-the-qr-code-to-the-customers-computer)

In a Support session you can show the QR code on the customer’s computer, so they only have to point their phone at the screen.

1. Confirm the computer first (**Confirm and take control** on the **Is this your customer’s computer?** card). Before that, sending shows **Confirm the machine’s identity first.**
2. Create a code, then select **Send QR to computer** in the panel.

The customer sees a window titled **Scan this with your phone camera** with the QR code, the line “Or open view\.blink.izt.app and enter 123 456” (on an online instance), “Sent by technician:” with your name, and a **Close** button. The window closes by itself when a phone joins, and when the code is cancelled or expires or the session ends.

Your toolbar reports what happened: **QR code shown on the customer’s computer**, **The customer closed the QR code window**, or **The QR code could not be shown**. While the window is open, the panel shows **Close QR on computer** to take it down again.

**Send QR to computer** is not offered in Access sessions, or when the customer’s support tool is too old to show the window. In those cases give the customer the code or the link yourself.

## Accept the phone

[Section titled “Accept the phone”](#accept-the-phone)

When the customer enters the code or opens the link, their phone waits for a technician. Everyone in the session with the Blink View permission sees a prompt in the viewer:

* **iPhone, Safari wants to share its camera** (the phone’s model and browser, as the phone reports them).
* Below it: the code (**Code 123 456**) or **Direct link**, who created it, and the time left.
* **Accept** and **Deny**.

The phone waits 2 minutes for an answer. If nobody answers, the request expires: your toolbar shows **Blink View: nobody accepted iPhone, Safari in time** and the phone shows **No answer from your technician**. While a phone is waiting, the **Blink View** button shows a dot.

The first technician to answer decides for everyone. After **Accept**, the toolbar shows who accepted it and the customer’s phone asks for camera access. After **Deny**, the customer sees **Your technician declined**.

## Work with the camera

[Section titled “Work with the camera”](#work-with-the-camera)

Once the phone is live, its camera appears in a tile in the viewer, with the phone’s model and browser as the caption. Everyone in the session sees the tile, including technicians without the Blink View permission.

* **Make larger** and **Make smaller** change the size of the tile.
* **Swap with the screen** puts the camera in the main area and the computer’s screen in the tile. Select it again to swap back.
* While the picture loads, the tile shows **Connecting to the camera…**, and **Reconnecting…** if the connection drops.

The customer chooses what the camera points at: they can switch between the front and back camera and turn on the flashlight where the phone supports it. If they switch to another app or lock the phone, you see a still picture until the page is back on screen. If the phone loses its connection, it has about 30 seconds to come back before the camera ends.

Only one phone camera can be live in a session. While one is live, the panel shows **End camera** instead of **Create code**, and accepting another phone shows **A phone camera is already live in this session**.

## End Blink View

[Section titled “End Blink View”](#end-blink-view)

Any of these ends the camera:

* **End camera** in the Blink View panel.
* The X on the camera tile (**End the camera**). It is there for technicians with the Blink View permission or the permission to end the session.
* The customer taps **End** on their phone.
* The session ends.

The toolbar then shows **Blink View ended:** with the reason, for example “a technician ended it” or “the customer ended it”. If the customer taps **Cancel** while their phone is still waiting, you see **Blink View: the customer cancelled**.

## Recording and history

[Section titled “Recording and history”](#recording-and-history)

The phone camera is recorded as its own file next to the session’s screen recording. It plays in the session player and can be downloaded from **Recordings**. See [Play and manage recordings](/use/recordings/).

Every code, accept, deny, start and end is written to the session’s timeline and to **Activity**. See [Review session history](/use/session-history/).

If something does not work, see [Fix Blink View problems](/troubleshooting/blink-view/).

# Blink View on the customer's phone

> What the customer does on their phone when a technician asks to see through its camera with Blink View, from entering the code to ending the camera.

This page is for the person being helped. Your technician may ask to see through your phone’s camera, for example to look at a cable, a light on a device or a label. You do this in your phone’s web browser: there is no app to install. Share this page with customers who want to know what to expect.

Blink View works best in Safari on an iPhone or iPad and in Chrome on Android. Other browsers may work.

## Open Blink View

[Section titled “Open Blink View”](#open-blink-view)

Your technician gives you a 6-digit code, a QR code, or both.

**With a code:**

1. On your phone, open **view\.blink.izt.app**.
2. Under **Enter the code your technician gave you**, type the 6 digits. You can also paste the code.
3. The page continues by itself after the last digit, or tap **Continue**.

**With a QR code:** point your phone’s camera at the QR code your technician shows you and open the link. The QR code may also appear on your computer in a window titled **Scan this with your phone camera**. The code is then filled in for you; tap **Continue**.

Some Blink servers do not use codes. In that case your technician sends you a link or shows you a QR code: open it on your phone and you go straight to the next step.

If the code is not accepted, the page shows “That code didn’t work. Check it with your technician.” Codes are valid for 10 minutes and work only once, so ask your technician for a new one.

## Wait for your technician

[Section titled “Wait for your technician”](#wait-for-your-technician)

The page shows **Waiting for your technician**: “Your technician needs to accept this phone. Your camera stays off until they do.” Your technician sees your phone’s model and browser (for example “iPhone, Safari”) and accepts or declines it.

* To stop, tap **Cancel**.
* If your technician declines, you see **Your technician declined**.
* If nobody answers within 2 minutes, you see **No answer from your technician**. Ask for a new code.

## Allow the camera

[Section titled “Allow the camera”](#allow-the-camera)

Once your technician accepts, the page shows **Starting your camera** and your browser asks to use the camera. Allow it. If you refused by mistake, the page shows **Camera access is off** with steps for your browser; follow them and tap **Try again** or **Reload page**.

## Share your camera

[Section titled “Share your camera”](#share-your-camera)

Your camera picture fills the screen, and the top bar shows **Connected to** your technician’s name and company. The page starts with the back camera.

* **Switch** changes between the back and front camera.
* **Light** turns the flashlight on and off. It appears only on phones and browsers that support it.
* Tap the picture to focus on that spot, where your phone supports it.
* Hold the phone in portrait or landscape, whichever shows the problem best.

Keep the page open on screen while you share. If you switch to another app or lock the phone, your technician sees a still picture until the page is back on screen, and the page shows **Paused** when you return to it. On some phones the page shows “Keep your screen on while you share.” because it cannot keep the screen awake by itself.

If your connection drops for a moment, the top bar shows **Reconnecting…** and the camera comes back on its own. Reloading the page also reconnects you.

## Stop sharing

[Section titled “Stop sharing”](#stop-sharing)

Tap **End** at any time. The page shows **Camera sharing ended** and the reason, for example “You stopped sharing your camera.” or “Your technician ended the camera.” followed by “You can close this page.” The camera also stops when your technician ends it or the support session is over.

## What Blink View can see

[Section titled “What Blink View can see”](#what-blink-view-can-see)

As the page says: “Blink View shares your camera only. Nothing else on this phone.” Your technician sees only what the camera points at. Blink View does not use the microphone and cannot see your phone’s screen, apps, photos or files.

If your technician’s company records its sessions, the camera picture may be recorded along with the session.

# Chat with the customer

> Send text messages and view-once secret messages to the person at the computer, in Support and Access sessions and before you connect to an Access device.

Chat lets you write to the person at the remote computer without taking over their screen or calling them. You can chat:

* in a **Support session**, with the customer you are helping;
* in an **Access session**, with the person signed in on the device;
* **before you connect** to an Access device, with its signed-in user, for example to ask “Can I connect now?”. The conversation carries on into the session if you then connect.

Chat is started by the technician. The one exception is a Support session, where the customer can open the chat from their banner. The person signed in on an Access device cannot start a chat; they can only answer yours.

## What you need

[Section titled “What you need”](#what-you-need)

* **Your plan** must include **Chat**. Secret messages also need **Secret messages**. Both are part of Blink Core and Blink Pro. See [Understand your plan and its limits](/configure/plans-and-limits/).
* **Your role** needs **Chat (support)** to chat in Support sessions and **Chat (access)** to chat with Access devices. The starter **Technician** and **Admin** roles have both, the **Owner** role has them too, and **Viewer** has neither. See [Roles and permissions](/configure/roles/).
* **An Access device** must run an agent version with chat. Older agents show **Update the agent to chat with this device**. See [Keep agents up to date](/install/agent-updates/).

## Chat in a Support session

[Section titled “Chat in a Support session”](#chat-in-a-support-session)

1. In the viewer toolbar, select **Chat**. The chat panel opens on the right of the viewer.
2. Type your message in **Write a message** and press Enter (Shift+Enter starts a new line).

The chat window opens on the customer’s screen when your first message arrives. See [What your customer sees](/use/what-customers-see/#chat-with-your-technician).

When the customer opens the chat themselves from their banner, the panel opens in your viewer by itself, and the conversation shows **The customer opened the chat**.

If the customer’s computer is reconnecting, the panel says **Reconnecting to the customer…** and the messages you send wait for it.

## Chat in an Access session

[Section titled “Chat in an Access session”](#chat-in-an-access-session)

In an Access session the viewer has the same **Chat** button and panel. The panel is headed with the signed-in user’s name (or the device’s name), and your messages go to the person signed in on the device.

An Access session is otherwise silent: the signed-in user sees no banner. A chat window is the exception. Once you send a message, the user sees it in a chat window on their screen, so they know a technician is there. If a chat is already open when you connect, the user’s chat window shows **The technician connected to this computer**.

## Chat before you connect

[Section titled “Chat before you connect”](#chat-before-you-connect)

You can chat with the signed-in user of an Access device without starting a session:

1. In the console, open **Access**.
2. Select the chat button on the device’s row, or open the device and select **Chat**.
3. The chat opens in a panel at the bottom right of the console. Under the user’s name it shows **Signed in:** and the account signed in on the device.
4. Write your message. It appears in a chat window on the user’s screen.

The panel stays open while you move between devices in the console. When the user agrees, select **Connect** in the panel header: the Access session starts and the conversation carries on in the viewer, with your earlier messages.

The chat button is greyed out when nobody can receive the message. Hover over it to see why:

| Message                                       | What it means                          |
| --------------------------------------------- | -------------------------------------- |
| **No user signed in**                         | Nobody is signed in on the device.     |
| **Device offline**                            | The device is not connected right now. |
| **Device revoked**                            | The device was revoked.                |
| **Update the agent to chat with this device** | The device runs an agent without chat. |

When the device’s screen is locked, you can still write: the button’s tooltip adds **Screen locked: messages show after the unlock**.

A chat before a session closes by itself after an hour without messages, and when a different user signs in on the device, so a new user never sees an earlier user’s conversation. Your next message then starts a new chat.

Messages to a device are never queued: when the device goes offline or the user signs out, the panel says the messages cannot be delivered now.

### Replies while the panel is closed

[Section titled “Replies while the panel is closed”](#replies-while-the-panel-is-closed)

When a device’s user answers and you do not have that chat open, a chat icon with a count appears at the top of the console, and the console shows a short notice such as **Reply from FRONT-DESK**. Neither shows the message itself. Select the icon to see **Chat replies**, one row per device, and select a device to open its chat.

## Writing and reading messages

[Section titled “Writing and reading messages”](#writing-and-reading-messages)

* Messages are plain text, up to 4,000 characters. A counter appears as you get close to the limit.
* The panel shows who wrote each message and when, and lines such as **Cody joined** or **Session ended**.
* **Seen** with a time appears under your last message the customer has read, and *Ann is typing…* shows while they write.
* Every technician in the session sees the same conversation and can write in it.
* If a message cannot be sent, it is marked **Not sent** with the reason, and **Retry** or **Remove**.

The customer sees your name as it is set under [Choose the name customers see](/configure/technician-name/), with your initials in place of a picture.

## Unread messages

[Section titled “Unread messages”](#unread-messages)

* In the viewer, the **Chat** button shows the number of messages you have not read while the panel is closed.
* For chats before a session, see [Replies while the panel is closed](#replies-while-the-panel-is-closed).

The customer gets an unread mark too. See [What your customer sees](/use/what-customers-see/#chat-with-your-technician).

## Secret messages

[Section titled “Secret messages”](#secret-messages)

A secret message is for something that must not stay anywhere, such as a password or a one-time code. Secrets work in both directions: you can send one to the customer, and the customer can send one to you.

A secret:

* **can be viewed once**. After it is revealed, its text shows for 30 seconds and is then gone for good;
* **expires** if nobody opens it in time;
* **is never kept**. It does not appear in the session history, the recording, the session log or the activity log. Only the fact that a secret was sent, viewed or expired is kept, with the times;
* **stays out of the live view**. While a secret is on the customer’s screen, you and the recording see a grey block labelled **Secret** in its place.

### Send a secret

[Section titled “Send a secret”](#send-a-secret)

1. In the chat panel, select **Secret** under the message box.
2. Type the secret in **Secret (shown once to the customer)**. It is hidden as you type, like a password.
3. Under **Expires after**, keep the default or choose **5 min**, **15 min** or **60 min**. The default is set by your administrator (see [Security settings](/configure/security-settings/#chat)).
4. Select **Send secret**. Press Escape to go back to a normal message.

The panel shows **Secret sent** and when it expires, then **Viewed** with the time once the customer has opened it, or **Expired**.

In a Support session, you can send a secret only after you have confirmed the computer: until then the panel says **Confirm the customer’s computer before sending a secret.** See [Confirm it is the right computer](/use/support-sessions/#confirm-it-is-the-right-computer).

On the customer’s screen, the secret arrives as a card with **Reveal** and the time left. Only the customer can reveal it: clicking **Reveal** or **Copy** with your remote mouse does nothing.

### Receive a secret from the customer

[Section titled “Receive a secret from the customer”](#receive-a-secret-from-the-customer)

A secret from the customer shows as **Secret from** and their name, with the time left.

1. Select **Reveal**. The text shows for 30 seconds.
2. Select **Copy** to copy it to your own computer’s clipboard, or **Hide** to close it sooner.

Any technician in the session can reveal it, but only once: the first one to select **Reveal** sees it, and everyone else sees **Viewed by** and that technician’s name. The customer’s secrets always use the default lifetime from the security settings.

Caution

Once you copy a secret, it is on your computer’s clipboard like anything else you copy. If you paste it into the remote computer with the shared clipboard, it travels as ordinary clipboard text.

If your plan does not include **Secret messages**, the **Secret** toggle is not shown and **Reveal** is greyed out with **Secret messages are not available**.

## After the chat

[Section titled “After the chat”](#after-the-chat)

The conversation is part of the session’s history:

* **Sessions**: the session’s details show the **Chat** with every message. See [Review session history](/use/session-history/#the-chat-transcript).
* **Recordings**: the session player has a **Chat** tab next to **Events**. See [Play and manage recordings](/use/recordings/#chat).
* **Access**: a device’s details list its **Chats**, including those that never led to a session.

A Support session’s chat ends with the session. Deleting a Support session deletes its chat too.

# Control the computer

> Use the mouse and keyboard on the remote computer, type long text with Type text, send Ctrl+Alt+Del and share the clipboard.

Once you have control of a session, your mouse and keyboard work on the remote screen inside the viewer. In a support session, control starts after you confirm the customer’s computer (see [Run a support session](/use/support-sessions/#confirm-it-is-the-right-computer)).

## Mouse and keyboard

[Section titled “Mouse and keyboard”](#mouse-and-keyboard)

1. Click the remote screen. The status strip at the bottom changes from **click to capture keyboard** to **keyboard captured**.
2. Use the mouse and keyboard as if you were sitting at the computer.

When you click outside the screen or switch to another window, Blink releases every key you were holding, so nothing gets stuck down on the remote computer.

If the toolbar shows **View only**, your role lets you watch but not control. If it shows **Loading permissions…** or **Permissions not loaded**, input starts as soon as your permissions arrive.

On a Mac customer’s computer, your mouse and keyboard only work after the customer allows **Accessibility** for Blink. The viewer tells you when that is missing. See [What your customer sees](/use/what-customers-see/#permissions).

### Ctrl+Alt+Del

[Section titled “Ctrl+Alt+Del”](#ctrlaltdel)

Pressing Ctrl+Alt+Del on your own keyboard never reaches the remote computer’s lock or sign-in screen. In Access sessions on Windows, select **Ctrl+Alt+Del** in the toolbar instead. The button is not shown in Backstage.

### The Command key on a Mac

[Section titled “The Command key on a Mac”](#the-command-key-on-a-mac)

If you work on a Mac and the remote computer runs Windows, the toolbar shows a **⌘** button that decides what your Command key sends:

* **Win** (the default): ⌘ sends the Windows key.
* **Ctrl**: ⌘ sends Ctrl, so ⌘C and ⌘V copy and paste the way Windows shortcuts expect.

Select the button to switch. Blink remembers the choice in this browser.

## Type text

[Section titled “Type text”](#type-text)

**Type text** types a block of text on the remote computer as real keystrokes. Use it for passwords, long commands and fields that block pasting.

1. Click into the field on the remote computer where the text should go.

2. Select **Type text** in the toolbar.

3. Enter or paste the text. Turn on **Hide characters** for a password.

4. Choose a **Speed**:

   * **Fast**: most applications.
   * **Careful**: slow or busy applications.
   * **Slowest**: Windows 11 Notepad, or if the text comes out garbled.

5. Select **Type** (or press Ctrl+Enter).

The dialog shows the character count and roughly how long typing will take. You can type up to 4,096 characters at a time. Progress appears in the transfer panel under the toolbar, where **Stop** cancels typing part way.

The text is encrypted for the remote computer before it leaves your browser, and it is never stored or written to logs. Type text needs a current Chrome, Edge, Firefox or Safari. If your browser cannot encrypt it, the button is disabled and says so.

## Shared clipboard

[Section titled “Shared clipboard”](#shared-clipboard)

When your role includes the clipboard, text is shared both ways:

* **From the computer to you**: text copied on the remote computer arrives on your clipboard automatically (as soon as the viewer has focus). The toolbar flashes **clipboard received**.
* **From you to the computer**: press Ctrl+V in the viewer. Blink sends your clipboard to the remote computer first, then pastes it there.

The clipboard carries text only, up to 64 KB. If you paste more, the toolbar shows **clipboard too large (max 64 KB)** and nothing is pasted; if the customer copies more, it shows **customer clipboard too large (max 64 KB)**. Use [Transfer files](/use/transfer-files/) for larger content.

Your browser may ask for permission to read the clipboard the first time. If you block it, the toolbar shows **clipboard access blocked** and Ctrl+V pastes whatever is already on the remote computer’s clipboard.

# Keyboard shortcuts

> Keys that work in the viewer, Type text, the remote terminal and the session player.

Blink has a small set of shortcuts. Everything else you type in the viewer goes to the remote computer.

## Viewer

[Section titled “Viewer”](#viewer)

| Key                              | What it does                                                                                                                                 |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Click the remote screen          | Captures the keyboard. The status strip shows **keyboard captured**.                                                                         |
| Ctrl+V                           | Sends your clipboard to the remote computer, then pastes it there. See [Control the computer](/use/control-and-clipboard/#shared-clipboard). |
| ⌘ (Mac, Windows remote computer) | Sends the Windows key by default, or Ctrl when you switch the **⌘** toolbar button.                                                          |

Use the **Ctrl+Alt+Del** toolbar button instead of the keys; see [Control the computer](/use/control-and-clipboard/#ctrlaltdel).

## Type text

[Section titled “Type text”](#type-text)

| Key                           | What it does                                   |
| ----------------------------- | ---------------------------------------------- |
| Ctrl+Enter (⌘+Enter on a Mac) | Types the text.                                |
| Enter                         | Types the text when **Hide characters** is on. |
| Esc                           | Cancels and closes the dialog.                 |

## Remote terminal

[Section titled “Remote terminal”](#remote-terminal)

The keys depend on your own computer, not the remote one. On Windows and Linux:

| Key                         | What it does                                                  |
| --------------------------- | ------------------------------------------------------------- |
| Ctrl+C                      | Copies the selection; with nothing selected, interrupts (^C). |
| Ctrl+V, Shift+Insert        | Paste.                                                        |
| Ctrl+Shift+C / Ctrl+Shift+V | Copy / paste.                                                 |
| Right-click                 | Copies the selection, or pastes when nothing is selected.     |
| Esc Esc                     | Leaves the terminal (focus moves to the terminal’s bar).      |

On your Mac:

| Key         | What it does                                              |
| ----------- | --------------------------------------------------------- |
| ⌘C          | Copies the selection.                                     |
| ⌘V          | Paste.                                                    |
| Ctrl+C      | Interrupt. Every Ctrl key goes to the shell.              |
| Right-click | Copies the selection, or pastes when nothing is selected. |
| Esc Esc     | Leaves the terminal.                                      |

Ctrl+W, Ctrl+T and Ctrl+N belong to your browser and close or open tabs. Leaving a terminal page asks first.

## Session player

[Section titled “Session player”](#session-player)

| Key                      | What it does                |
| ------------------------ | --------------------------- |
| Space                    | Play or pause.              |
| Left arrow / Right arrow | Back or forward 10 seconds. |

When the timeline slider has focus:

| Key                 | What it does                                                    |
| ------------------- | --------------------------------------------------------------- |
| Arrow keys          | Back or forward 10 seconds.                                     |
| Page Up / Page Down | Forward or back 1 minute.                                       |
| Home                | Start of the session.                                           |
| End                 | End of the session, or the live edge while it is still running. |

# Manage Access devices

> Rename, tag and group Access devices, push agent updates, and revoke or delete devices you no longer manage.

Access devices are listed under **Access** in the console. This page covers looking after them once they are enrolled. To enroll new devices, see [Create an enrollment key](/install/enrollment-keys/) and [Install the Access agent on Windows](/install/access-agent-windows/).

## The device list

[Section titled “The device list”](#the-device-list)

The cards at the top count **Devices**, **Online**, **Offline** and **Updates available**. If you can see the license (the **View license** permission), the **Devices** card also shows how many Access devices your plan allows, for example `12 of 25 in your plan`. When they are all in use, **Enroll a device** is greyed out with the tooltip **All Access devices in your plan are in use: new enrollments are refused. Remove a device, or add devices to your plan.** Devices already enrolled keep working. See [Access devices](/configure/plans-and-limits/#access-devices).

The list shows each device’s name, OS, agent version, groups and connection, and you can sort by name, OS, agent version or last seen.

Badges call out devices that need attention:

| Badge                                   | Meaning                                                                                                                                                                  |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **update**                              | A newer agent version is available.                                                                                                                                      |
| **revoked**                             | The device was revoked and cannot connect.                                                                                                                               |
| **blocked by IP rule**                  | The organization’s agent IP rule refused the device’s address. Hover for the address, country and when. It clears when the device next connects from an allowed address. |
| **IP rule**                             | The device is online, but one of its connections (an Access session or a terminal) was recently refused by the agent IP rule. Hover for details.                         |
| **Safe Mode** / **Safe Mode next boot** | See [Reboot and Safe Mode](/use/reboot-and-safe-mode/).                                                                                                                  |
| **possible clone**                      | Two computers keep connecting as this device. Its identity was probably copied with a disk image. Revoke it and enroll each computer on its own.                         |

A blocked device counts as offline: the **Offline** card shows how many of them are blocked, and the status filter has **Blocked by IP rule** to list them. The rule itself is on the **Organizations** page; see [Restrict access by IP address and country](/configure/ip-and-country-rules/).

Select a device to open its details: status, host name, OS, agent version, last seen, boot mode, last reboot, BitLocker status, pending restarts, enrollment date, groups, tags, open terminals, session history and the device’s **Chats** (see [The chat transcript](/use/session-history/#the-chat-transcript)). To chat with the device’s signed-in user, select **Chat**; see [Chat with the customer](/use/chat/#chat-before-you-connect). If your plan does not include **Session history**, the details show **Not included in your plan: Session history** in its place. A device the agent IP rule refused also shows an **IP rule** row with the last refusal.

### If your plan does not include Unattended Access

[Section titled “If your plan does not include Unattended Access”](#if-your-plan-does-not-include-unattended-access)

The **Access** page stays, so you can clean up the devices you have, and shows **Not included in your plan: Unattended Access** with the note **Enrolled devices stay listed so you can rename, revoke or delete them. Connecting and enrolling are not available.** **Enrollment** disappears from the console.

## Rename, tag and move a device

[Section titled “Rename, tag and move a device”](#rename-tag-and-move-a-device)

You need **Edit devices**.

1. Open the device and select **Edit name, tags and groups**.
2. Change the **Name**.
3. Add **Tags**: type a tag and press Enter or a comma. Tags are searchable in the device list.
4. Tick or clear **Groups** to move the device in or out of groups.
5. Select **Save**.

You can only move a device into or out of a group where you have **Edit devices**. In the **Overview**, change a device’s groups from inside its own organization.

## Device groups

[Section titled “Device groups”](#device-groups)

Groups decide which devices someone with group-only access can reach. Open **Groups** in the console.

* **New group**: name a group and select **Create group**. Devices join a group through an enrollment key for that group, or when you move them in.
* **Rename** or **Delete** a group from its details. Deleting a group removes the roles given on it; its devices stay enrolled and just leave the group.
* A group’s details list its devices and, under **Group roles**, the members who have a role on that group only.

Giving people roles on groups is covered in [Limit access with groups](/configure/groups/).

## Update the agent

[Section titled “Update the agent”](#update-the-agent)

When a newer agent release is available, the device shows **update** and its details show the version. Select **Update** in the device’s details to push it now. The details then show the result under **Last update**. This needs **Edit devices**.

## Revoke a device

[Section titled “Revoke a device”](#revoke-a-device)

Revoke a device when it is lost, stolen or should no longer be reachable. You need **Remove devices**.

1. Open the device and, under **Danger zone**, select **Revoke**.
2. Confirm with **Revoke device**.

The device’s credential stops working, its connection drops and its open sessions end. The record stays, marked **revoked**, so you can see what happened. No enrollment key brings it back; only **Un-revoke** does.

**Un-revoke** lets the device connect again with the key it was enrolled with. Only do this for a computer you trust: whoever has it gets unattended access back.

A revoked device does not count against the Access devices in your plan, so revoking one frees a device. Un-revoking makes it count again: it needs **Unattended Access** in your plan and is refused when all Access devices are in use.

## Delete a device

[Section titled “Delete a device”](#delete-a-device)

1. Open the device and, under **Danger zone**, select **Delete**.
2. Confirm with **Delete device**.

Deleting removes the device record entirely. The installed agent can no longer connect, and the device no longer counts against the Access devices in your plan. A device whose agent was uninstalled does not count either.

Tip

Revoke when you want to keep a record of the device. Delete when you want it gone.

# Reboot and Safe Mode

> Restart an Access device remotely, boot it into Safe Mode with Networking, and reconnect when it comes back.

You can restart an Access device from the console or from the viewer, and follow it as it goes down and comes back. You can also restart it into Safe Mode with Networking for repairs that need a minimal Windows. Remote reboot is for Access devices only.

Your role needs **Reboot** for a normal restart, and **Safe Mode reboot** for Safe Mode. The Technician starter role includes **Reboot** but not **Safe Mode reboot**.

## Reboot from the viewer

[Section titled “Reboot from the viewer”](#reboot-from-the-viewer)

1. In an Access session, select **Power** in the toolbar.
2. Choose **Reboot**, or **Reboot into Safe Mode with Networking**.
3. Read the warnings, then select **Reboot now**.

Leave **Reconnect automatically when it’s back online** on (the default; this browser remembers your choice) to have the viewer start a new session as soon as the device is back. If you started in Backstage, the new session opens in Backstage too, unless the device came back in Safe Mode.

While the device restarts, the viewer shows **Rebooting** with the device name and how long it has been offline. When it is back, it reconnects, or shows **Reconnect** if you turned automatic reconnect off. If the device is still offline after 15 minutes, choose **Keep waiting** or **Close**.

## Reboot from the console

[Section titled “Reboot from the console”](#reboot-from-the-console)

1. Open **Access**.
2. Select the power icon on the device’s row, or open the device and select **Reboot…**.
3. Choose the mode and select **Reboot** followed by the device name.

The console shows **Restarting…** and then **Rebooting · offline** on the device, and tells you when it is back online.

## What a normal reboot does

[Section titled “What a normal reboot does”](#what-a-normal-reboot-does)

Windows restarts in 5 seconds and force-closes all programs. Anyone signed in loses unsaved work. Active sessions on the device end.

## What Safe Mode with Networking does

[Section titled “What Safe Mode with Networking does”](#what-safe-mode-with-networking-does)

Windows starts with only essential drivers and services, and Blink connects in Safe Mode so you can keep working.

* Wi-Fi usually does not work in Safe Mode, so the device needs a wired network.
* There is no audio, and the display runs at basic resolution.
* The next restart returns to normal Windows.
* If Blink cannot reach your Blink address within 10 minutes, the computer restarts normally by itself.

While a device runs in Safe Mode, the console shows a **Safe Mode** badge on it and a **Reboot normally** button in its details. A device set to start in Safe Mode at its next restart shows **Safe Mode next boot**.

## Warnings to watch for

[Section titled “Warnings to watch for”](#warnings-to-watch-for)

The reboot dialog adds warnings when they apply:

* **BitLocker is on.** For a Safe Mode reboot (or a normal one that clears the Safe Mode setting), Blink suspends BitLocker for that restart. Keep the recovery key at hand in case Windows asks for it.
* **Windows updates are waiting to install.** The restart can take much longer, and Safe Mode with pending updates can end in *Undoing changes*.

The device’s details also list any **Pending restart** (Windows Update, component servicing or file renames) and the **Last reboot** with who requested it and how it ended.

## If the reboot does not happen

[Section titled “If the reboot does not happen”](#if-the-reboot-does-not-happen)

If the device does not confirm the request, the viewer tells you and keeps the session running while it waits to see whether the device goes down. If the device reports an error, the message says at which step it failed. A device that is not back after a while is marked **not back yet (may be installing updates)** in its details.

# Play and manage recordings

> Watch session recordings in the browser, even live, jump to events on the timeline, download files and delete recordings.

Session recording and terminal transcripts are part of Blink Pro (**Session recording** and **Terminal history** in your plan; see [Understand your plan and its limits](/configure/plans-and-limits/#blink-core-and-blink-pro)). When your plan includes them, recording is automatic: Blink records each monitor a technician views as its own video, the computer’s sound as a separate audio file, and every terminal as a transcript. A monitor nobody viewed is not recorded. There is no switch to turn recording off.

## When your plan does not include recording

[Section titled “When your plan does not include recording”](#when-your-plan-does-not-include-recording)

If your plan does not include **Session recording**, the **Recordings** page says **Not included in your plan: Session recording** with *New sessions are not recorded. Existing recordings stay available.* Without **Terminal history** it says **Not included in your plan: Terminal history** with *New terminals are not transcribed. Existing transcripts stay available.*

Recordings and transcripts made earlier stay where they are: you can still play, download and delete them, with the same permissions as before. A session keeps what it started with, so a session started without recording stays without one even after your plan changes. See [When you change plans](/configure/plans-and-limits/#when-you-change-plans).

## Find a recording

[Section titled “Find a recording”](#find-a-recording)

1. In the console, open **Recordings**.
2. Search by session code, device, shell or user. Select **Terminals** to show only terminal transcripts.

Recordings are grouped by session. Each group lists its files: **Monitor 1**, **Monitor 2**, **Backstage**, **Audio** and any **Terminal** transcripts, with duration, resolution and size. A **live** badge marks a recording still in progress.

You can also open a session’s recording from **Sessions** (the video button on its row, or **Recording** in its details).

Your role decides what you can do: **View recordings** to play, **Download recordings** to download, **Delete recordings** to delete.

## Play a session

[Section titled “Play a session”](#play-a-session)

Select **Play** on a session. The session player opens in a new tab and plays every monitor and the audio on one shared timeline.

* **Monitor tabs** switch which monitor you watch. A dot on a tab means that monitor was recorded at the current moment.
* **Play/pause**, **back 10 s** and **forward 10 s**, and a speed of 1x, 1.5x, 2x or 4x.
* The readout shows the time into the session and the wall-clock time at the playhead.
* Volume and mute control the session audio.

When the customer shared a phone camera with [Blink View](/use/blink-view/), the camera gets its own tab and lane, named **Camera ·** followed by the phone, for example *Camera · iPhone, Safari*.

If the monitor you picked was not being viewed at that moment, the player says so and offers **Jump to next recording of this monitor**, or to show another monitor recorded at that time.

### The timeline

[Section titled “The timeline”](#the-timeline)

Under the video, the timeline has one lane per monitor, one for **Audio**, one for **Technicians** (who was viewing when) and one for **Events**. Click or drag anywhere on it to seek.

The legend explains the shading: **Streamed**, **Not viewed or no audio**, **Muted by a technician** and **Agent offline**.

### Events

[Section titled “Events”](#events)

The **Events** list beside the video shows what happened during the session, such as technicians joining and leaving, connection changes, security events, file transfers and power actions. Select an event to jump to just before it. Use the chips to show or hide kinds of events; a few noisy kinds, such as typed text and audio changes, are hidden until you switch them on. Your choices are remembered. The **Blink View** chip covers the phone camera: *Blink View requested*, *Blink View started*, *Blink View ended* and *Blink View denied*.

Events, muted spans and the technician lane need **View logs**. Without it, the player says they are hidden. They also need a session timeline: for a session started while your plan did not include **Session timeline**, the player says **Event markers are not included in your plan (session timeline)**.

### Chat

[Section titled “Chat”](#chat)

When the session had a chat, the side panel has two tabs, **Events** and **Chat**, with the number of chat lines on the tab. **Chat** lists the messages on the session’s clock; select one to jump to just before it. Secret messages appear only as sent, viewed or expired, never with their text, and the recording shows a grey **Secret** block where a secret was on the customer’s screen. Chat started before an Access session is marked **before**. If the chat is very long, the player says **Only the latest messages are shown here.**; the session’s details in **Sessions** show it all. See [Review session history](/use/session-history/#the-chat-transcript).

### Watch a live session

[Section titled “Watch a live session”](#watch-a-live-session)

A session that is still running plays too. Select **Go live** to jump to the newest moment and keep following it; the player shows **Live** while it does.

## Download files

[Section titled “Download files”](#download-files)

Downloads need **Download recordings**.

* In the session player, select **Download** and pick a monitor, a phone camera or the audio file.
* In **Recordings**, select the download button on a file.

Monitor files are video only; the audio is its own file. A Blink View camera is listed as **Phone camera** and downloads as an `.mp4` file. Long recordings may be split into parts.

## Delete a recording

[Section titled “Delete a recording”](#delete-a-recording)

You can delete the recording of a session that has ended. The video and audio are removed; the session, its log and its timeline stay.

1. In **Recordings**, select the delete button on a session, or tick several sessions and select **Delete N recordings**.
2. Confirm.

Sessions are deleted one at a time with a progress bar; **Stop** finishes the one in progress and leaves the rest. Right after a session ends, its recording may take a few seconds to finalize; if Blink says it is still being finalized, try again shortly.

To delete a whole support session with its recording and log, see [Review session history](/use/session-history/#delete-a-support-session).

## Terminal transcripts

[Section titled “Terminal transcripts”](#terminal-transcripts)

Terminal transcripts play in their own player: select **Play transcript** in the session player’s **Terminals** list, or the play button on a transcript in **Recordings**. The transcript player can search the output and step through matches, play and pause, and change speed.

Transcripts download as `.cast` files. A `.cast` file contains raw terminal output; replaying it in a real terminal runs its escape sequences.

Deleting a session’s recording keeps its transcripts. Delete a transcript on its own with its delete button in **Recordings**, once the terminal is closed. That needs **Delete recordings (any)**: the (own) variant is not enough, so you cannot delete the transcript of a terminal you opened unless your role covers everyone’s.

A transcript marked **truncated** reached the recording cap; after that point only the output following each input was kept.

# Open a remote terminal

> Open a PowerShell, Command Prompt or Mac login shell on an Access device or a customer's computer, and review the transcript afterwards when your plan keeps one.

The remote terminal opens a command window on the remote computer in its own browser window, without taking over the screen. When your plan includes **Terminal history** (part of Blink Pro), everything shown in a terminal is recorded as a transcript you can replay later.

| Where                    | Shells                                                        | Runs as                                                                                                                                          |
| ------------------------ | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Access device (Windows)  | PowerShell, Command Prompt                                    | **SYSTEM (full control)**, or **Signed-in user (standard rights)**                                                                               |
| Support session, Windows | PowerShell, Command Prompt                                    | **Customer**, or an administrator shell once the session is elevated (shown as **SYSTEM (session is elevated)** or **Administrator (elevated)**) |
| Support session, Mac     | Login shell (the customer’s own shell, zsh on a standard Mac) | **Customer**                                                                                                                                     |

## Who can use it

[Section titled “Who can use it”](#who-can-use-it)

The terminal needs its own permission: **Terminal (access)** for devices, **Terminal (support)** for support sessions. These permissions are only granted by a role that names them explicitly. Out of the box, only the **Owner** role has them; the Admin and Technician starter roles do not. An administrator can add them to a custom role (see [Roles and permissions](/configure/roles/)).

Your plan must also include **Remote terminal**. If it does not, the **Terminal** button does not appear, and a terminal window opened anyway says **The remote terminal is not included in your plan.**

Running a support terminal as administrator also needs **Run as admin (support)** and an elevated session (see [Run as administrator](/use/run-as-administrator/)). Until the session is elevated, the option is greyed out.

## Open a terminal on an Access device

[Section titled “Open a terminal on an Access device”](#open-a-terminal-on-an-access-device)

1. In the console, open **Access**.

2. On the device’s row, select the terminal button to open a terminal with your last choice (PowerShell as SYSTEM the first time). Or select the arrow next to it and choose **Open as…** to pick.

3. In **Open a terminal**, choose the **Shell** and **Run as**:

   * **SYSTEM (full control)**.
   * **Signed-in user (standard rights)**: runs as the user without elevation, with their registry settings and mapped drives. If several users are signed in, pick the Windows session.

4. Select **Open terminal**.

The terminal opens in a new browser window. You can also open one from the **Terminal** button in an Access session’s viewer toolbar, or from the device’s details.

## Open a terminal in a support session

[Section titled “Open a terminal in a support session”](#open-a-terminal-in-a-support-session)

1. Confirm the customer’s computer in the viewer first.
2. Select **Terminal** in the toolbar, or the arrow next to it and **Open as…**.
3. Choose the **Shell** and **Run as**: **Customer**, or the administrator option once the session is elevated. Then select **Open terminal**.

The customer sees that a command window is open and who opened it, and can close it with **Close command windows** at any time. See [What your customer sees](/use/what-customers-see/#files-and-command-windows).

## Work in the terminal

[Section titled “Work in the terminal”](#work-in-the-terminal)

Copy and paste work like a normal terminal. Select **Keys** in the terminal’s bar for the full list; see also [Keyboard shortcuts](/use/keyboard-shortcuts/#remote-terminal).

* Right-click copies the selection, or pastes when nothing is selected.
* Press Esc twice to move focus out of the terminal.
* Ctrl+W, Ctrl+T and Ctrl+N belong to your browser. Leaving the page asks first.
* **Screen reader** exposes the terminal text to assistive technology.
* **End** closes the shell and everything it runs.

To get back to a terminal you already opened, use the arrow next to the terminal button: **Your open terminals** lists them. A device’s details list every open terminal on it, with **Close** where you are allowed to close it.

## Limits

[Section titled “Limits”](#limits)

* Up to 3 terminals per device or support session, and 10 per technician.
* A terminal closes after 30 minutes without input. Output does not count; a warning appears 2 minutes before.
* A terminal with no window attached for 2 minutes closes.
* Ending a support session closes its terminals.

## Transcripts

[Section titled “Transcripts”](#transcripts)

When your plan includes **Terminal history**, every terminal is recorded: the terminal button’s tooltip reads **Open a terminal (recorded)** and the picker says **Everything shown in this terminal is recorded.** Without it, the button reads **Open a terminal**, the terminal still opens, and no transcript is kept. See [Understand your plan and its limits](/configure/plans-and-limits/#blink-core-and-blink-pro).

Transcripts appear in **Recordings** with a **Terminals** filter, and in the session player’s **Terminals** list. See [Play and manage recordings](/use/recordings/#terminal-transcripts).

Deleting a session or its recording keeps its terminal transcripts. Each transcript is deleted on its own. Transcripts made earlier stay available after a plan change.

# Run as administrator

> Relaunch Blink with administrator rights on a customer's Windows computer, with admin credentials or the customer's approval.

In a support session, Blink runs with the customer’s own rights. Many fixes need more: installing software, changing system settings, or answering admin prompts. **Run as admin** relaunches Blink on the customer’s Windows computer with full administrator rights, and the session carries on.

Your role needs **Run as admin (support)**. In a support session you must also have confirmed the customer’s computer first.

## Elevate the session

[Section titled “Elevate the session”](#elevate-the-session)

1. In the viewer toolbar, select **Run as admin**.

2. Choose how to elevate:

   * **With admin credentials**: enter the **Admin username**, an optional **Domain** and the **Password**, then select **Elevate**. Use this when the customer is a standard user and you have an administrator account for the computer.
   * **Use UAC prompt**: use this when the customer’s own account is an administrator.

3. Ask the customer to click **Yes** on the Windows prompt that appears on their screen.

Blink relaunches with administrator rights and reconnects on its own. The toolbar button then reads **Admin**.

The credentials are encrypted for the customer’s computer before they leave your browser, used once and never stored. Elevation needs a current Chrome, Edge, Firefox or Safari.

Note

Elevation always needs the customer to click **Yes** at the computer, even when you enter admin credentials.

## What changes once elevated

[Section titled “What changes once elevated”](#what-changes-once-elevated)

* You can control windows and prompts that need administrator rights, including admin prompts that Blink shows on the normal desktop so you can see them.
* **Install Access** becomes available (see [Run a support session](/use/support-sessions/#turn-a-support-session-into-an-access-device)).
* In the terminal, **Run as** offers the administrator option. Terminals opened before elevation close with **The session was elevated. Open a new terminal to run as administrator.**
* The customer can no longer send you files from the banner.

## Access sessions

[Section titled “Access sessions”](#access-sessions)

On Access devices, Blink already runs with full rights. If the toolbar shows **Admin**, there is nothing to elevate. In Access sessions, your **Control (access)** permission covers running as admin.

## If elevation fails

[Section titled “If elevation fails”](#if-elevation-fails)

* If the customer clicks **No**, or does not answer, Blink keeps running with the customer’s rights. Try again when the customer is ready.
* If the button is disabled with a message about encryption, update your browser.

More fixes are in [Troubleshooting](/troubleshooting/).

# Review session history

> Find past support and Access sessions, read each session's timeline and log, and delete support sessions you no longer need.

Every session, support or Access, stays in the console after it ends. Its timeline and log are kept when your plan includes **Session timeline**, and its recording when your plan includes **Session recording** (both part of Blink Pro). A session keeps what it started with, even if your plan changes later. See [Understand your plan and its limits](/configure/plans-and-limits/#blink-core-and-blink-pro).

## Find a session

[Section titled “Find a session”](#find-a-session)

1. In the console, open **Sessions**.

2. Clear **Active only** to include ended sessions. It is on by default, so the list starts with running sessions.

3. Narrow the list:

   * Search by code, label, device, technician or organization.
   * Choose **Support (code)** or **Access (device)** to show one kind.

4. Select **Load older** at the bottom to page further back.

If your plan does not include **Session history**, **Sessions** lists live sessions only, and **Active only** is replaced by **Session history: not in your plan**.

Each row shows the session (the code for support, the device name for Access), the connection lights, the **Technician** who started it, the **Remote computer** (screen size, agent version, and icons when Blink ran as administrator or had audio), when it **Started** and its **Duration**. A **backstage** badge marks Backstage sessions.

To see the sessions of one device, open it under **Access**: its details end with a **Session history** list (or **Not included in your plan: Session history** when your plan does not include it).

## Session details

[Section titled “Session details”](#session-details)

Select a session to open its details.

* **Actions**: **View** (while it is live), **Full log**, **Recording**, **Device** (Access), **End** or **Delete**.
* **Timeline**: who connected on each side and when, for example *Code created by*, *Customer downloaded the tool*, *Agent connected*, technicians connecting and disconnecting, files sent, *Customer ended the session* and *Session ended*. With [Blink View](/use/blink-view/) it also shows *Blink View code created by* (or *Blink View link created by*), the phone asking to share its camera, *Blink View: … accepted by* or *denied by*, *Phone camera live* and *Phone camera ended*.
* **Chat**: the session’s chat, if there was one. See [The chat transcript](#the-chat-transcript).
* **Properties**: who started it, when it was created, connected and ended, its duration, whether the customer has downloaded the tool, the label and group, and the session id.
* **Remote computer**: screen size, agent version, whether it was **Elevated** and had **Audio**, and each monitor with its resolution.

If a recording was deleted, the details say who deleted it and when.

The timeline and the log need **View logs**. A session started while your plan did not include **Session timeline** keeps no timeline or log: its details say **Not included in your plan: Session timeline** with *This session was started without one, so it keeps no timeline.*, and there is no **Full log**.

## The chat transcript

[Section titled “The chat transcript”](#the-chat-transcript)

The **Chat** section of a session’s details shows the conversation with the customer: who wrote each message and when, and lines such as *Session started* or *Cody joined*. **Earlier messages** loads older ones. It says **No chat in this session.** when there was none. The timeline marks when the chat started with *Chat started*.

Secret messages never appear with their text. The transcript shows only what happened to them, whether it was viewed (with the time), expired or not viewed yet, for example *Secret from ann · expired*.

For an Access session, messages written before you connected sit under **Before the session**, and the rest under **In the session**. Chats with a device’s user that never led to a session are on the device: open it under **Access** and see its **Chats** list. Each row shows the first line, how many messages it has, who started it, whether it led to a session, and **open** while it is still going on. Select one to read it.

You can read a session’s chat whenever you can see the session. A device’s **Chats** list needs **Join access sessions** or **Chat (access)** on the device, and closed chats there also need **Session history** in your plan. Chats stay readable if your plan later drops **Chat**: the device then shows **Not included in your plan: Chat** with *Earlier chats stay readable.*

## The session log

[Section titled “The session log”](#the-session-log)

**Full log** (or **Log** in the viewer) opens the session’s detailed log in a new tab: every event from Blink and from the remote computer, with search, filters by level and source, and a choice of clock. Logs record what happened, not what was typed or copied.

The log is mostly useful when something went wrong; [Troubleshooting](/troubleshooting/) explains what to look for.

## Activity

[Section titled “Activity”](#activity)

**Activity** is the organization’s activity log: who did what, newest first. It needs **View activity**, and **Audit log** in your plan: without it, **Activity** is not in the sidebar, and the page says **Not included in your plan: Audit log** with *The organization audit log is not kept.* Chat appears there as *Started a chat*, *Sent a secret message*, *Viewed a secret message* and *Secret message expired*, never with the messages themselves. Blink View appears there too, as *Created a Blink View code*, *Accepted a Blink View phone*, *Refused a Blink View phone*, *Blink View started* and *Blink View ended*. Use it alongside the session list when you need to know who did something in the console.

## Delete a support session

[Section titled “Delete a support session”](#delete-a-support-session)

You can delete an ended support session together with its recording, its log and its chat. This cannot be undone. Terminal transcripts are kept.

1. In **Sessions**, find the ended session.
2. Select the delete button on its row, or **Delete** in its details.
3. Confirm with **Delete session**.

This needs **Delete support sessions**. Access sessions cannot be deleted this way; delete their recordings instead (see [Play and manage recordings](/use/recordings/#delete-a-recording)).

# Run a support session

> Create a one-time Support code, get the customer connected, confirm their computer and end the session when you are done.

A support session connects you to a customer’s Windows PC or Mac for one job. You create a code in the console, the customer types it on your join page, downloads the support tool and runs it. When the session ends, the tool closes and nothing stays installed.

## Create a Support code

[Section titled “Create a Support code”](#create-a-support-code)

1. In the console, open **Sessions**.

2. Select **Support code**.

3. In **New Support code**, fill in the optional details:

   * **Label**: a note that helps you tell sessions apart, for example *Printer at front desk*.
   * **Group**: if your role lets you create sessions only in certain groups, you must pick one of them. If you can create sessions across the organization, the group is optional; it decides who else in your team can watch the session.

4. Select **Create code**.

The console shows the code under **Give the customer this code**, with **Copy code** and **Copy join link** buttons and the time the code expires if nobody uses it.

Tip

In the **Overview** (all organizations), codes are created inside one organization. Choose the organization from **Support code in…** and the console switches to it and opens the dialog.

The code format (digits or letters, and how long) is set by your administrator, so your codes may look different from the examples here.

## Get the customer connected

[Section titled “Get the customer connected”](#get-the-customer-connected)

Tell the customer to:

1. Open your join page. It is your Blink address followed by `/join`, for example `https://yourname.onblink.cloud/join`. **Copy join link** copies it for you.
2. Type the code and select **Download the support tool**.
3. Open the download and follow the steps on the page.

The join page detects the customer’s computer and serves the Windows tool or the Mac app. On an iPad it asks the customer to use a computer instead. Each code works once and expires on its own.

For the steps from the customer’s side, including the Windows warning and the Mac permissions, see [What your customer sees](/use/what-customers-see/).

## Watch the connection come up

[Section titled “Watch the connection come up”](#watch-the-connection-come-up)

The Sessions list shows each session’s connection as two lights: **Agent** (the customer’s side) and **Tech** (your side). Hover a light, or select the session to open its details, to read its state.

| Agent state          | Meaning                                                          |
| -------------------- | ---------------------------------------------------------------- |
| waiting for customer | The code exists but the tool has not connected yet.              |
| connected            | The customer’s computer is connected.                            |
| reconnecting         | The connection dropped and Blink is waiting for it to come back. |
| disconnected         | The session is over.                                             |

The cards above the list count **Agents connected**, **Technicians viewing**, **Waiting for customer** and **Reconnecting**.

When the agent side turns green, select **View**. The viewer opens in a new tab.

## Confirm it is the right computer

[Section titled “Confirm it is the right computer”](#confirm-it-is-the-right-computer)

Before your mouse, keyboard, clipboard or files reach the computer, the viewer asks **Is this your customer’s computer?** and shows:

* **Computer**: the computer’s name.
* **Signed in**: the account signed in on it.
* **System**: the operating system.

Check the details with the customer, then select **Confirm and take control**. You can already see the screen and chat while the card is up; control, clipboard, file transfer, **Run as admin**, the terminal, **Install Access** and secret chat messages start only after you confirm.

Caution

If the customer does not recognize the computer, do not confirm. End the session and create a new code.

Each technician confirms for themselves. If the details change while the card is up, the viewer says **The computer changed. Check it again.** and shows the new details.

## Work in the session

[Section titled “Work in the session”](#work-in-the-session)

Everything you can do in the viewer is covered in its own page:

* [Use the viewer](/use/viewer/)
* [Chat with the customer](/use/chat/), including secret messages for passwords and codes
* [Control the computer](/use/control-and-clipboard/)
* [Transfer files](/use/transfer-files/)
* [Run as administrator](/use/run-as-administrator/) (Windows)
* [Open a remote terminal](/use/remote-terminal/)
* [See the customer’s phone camera with Blink View](/use/blink-view/), where you can also send the QR code to the customer’s computer

Other technicians in your team can open the same session from **Sessions** with **View**, if their role allows it. A technician whose role lets them watch but not control sees **View only** in the toolbar.

## Turn a support session into an Access device

[Section titled “Turn a support session into an Access device”](#turn-a-support-session-into-an-access-device)

On a Windows computer you can install the unattended Access agent straight from a support session, so you can reach the computer again later without a code. Your role needs **Install Access**. Your plan must include **Unattended Access** and **Install Access from Support**, and have a free Access device (see [Access devices](/configure/plans-and-limits/#access-devices)).

1. In the viewer toolbar, select **Install Access**.
2. If Blink is not running as administrator yet, the panel says **The agent must run as administrator first.** Select **Run as admin** and follow [Run as administrator](/use/run-as-administrator/), then open **Install Access** again.
3. Choose a **Device group** if your role requires one.
4. Select **Install**.

Blink installs the Access service on the computer (it starts automatically with Windows) and enrolls it into your organization. The customer is not prompted. When it finishes, the button reads **Access installed** and **Open device in console** takes you to the new device. See [Connect to an Access device](/use/access-sessions/).

## End the session

[Section titled “End the session”](#end-the-session)

You can end a session from either place:

* In the viewer, select **End**, then **End session**.
* In the console, open **Sessions** and select **End** on the session’s row.

The support tool on the customer’s computer closes and, if the session is recorded, the recording is finalized. The customer can also end the session themselves at any time from the banner, the tray icon or the Mac menu bar. The session’s chat ends with it.

If the customer’s computer loses its connection, Blink waits up to 2 minutes for it to come back before ending the session.

Note

Closing the viewer tab does not end the session. The customer’s tool stays connected until you or the customer end it, so you can reopen the viewer from **Sessions**.

## After the session

[Section titled “After the session”](#after-the-session)

Ended sessions stay in **Sessions**, with their recording when your plan includes **Session recording** and their log when it includes **Session timeline**. See [Review session history](/use/session-history/) and [Play and manage recordings](/use/recordings/).

# Transfer files

> Send files to the remote computer from the viewer, and accept or decline files the customer sends you.

Files go both ways in a session: you send files to the remote computer from the viewer, and a customer on Windows can send files to you. Your role needs file transfer for the session type (support or Access).

## Send files to the computer

[Section titled “Send files to the computer”](#send-files-to-the-computer)

1. In the viewer, select **Send file** and choose one or more files. Or drag files from your computer and drop them on the remote screen.
2. Watch progress in the transfer panel under the toolbar: name, size, progress, speed and time left.

Files are sent one at a time, in order. Select **Stop** on a row to cancel it. Each file is checked after it arrives, so a damaged transfer is never saved.

On the remote computer, files land in the **Blink** folder inside the user’s **Downloads** folder. A file never overwrites one that is already there; a number is added to the name instead, for example `report (2).pdf`. The customer sees a **File received** notification.

On an Access device, files go to the Downloads folder of the user signed in at the computer’s console. If nobody is signed in, the transfer is cancelled.

## Receive files from the customer

[Section titled “Receive files from the customer”](#receive-files-from-the-customer)

A customer on Windows sends you files with **Send file** on the banner, or **Send file to technician…** in the tray icon menu. While a file goes out, their banner shows its progress and a **Stop** button.

Note

Sending files to the technician is not available on a Mac, from an Access device, or while Blink runs as administrator on Windows.

When a file arrives, nothing is saved until you decide:

1. The file appears in the transfer panel as **received · accept to save**.
2. Select **Accept** to save it to your browser’s downloads, or **Decline** to throw it away.

If the file could run code on your computer (for example `.exe`, `.msi`, `.ps1`, `.bat`, scripts, shortcuts, disk images or Office files with macros), the panel warns you and the button reads **Save anyway**. Open such a file only if you expected it from that computer.

Your browser holds received files in memory until you accept or decline them: up to 4 files and 1 GB at a time. Accept or decline waiting files to make room for more.

## Limits

[Section titled “Limits”](#limits)

* You cannot browse the remote computer’s folders from the viewer and pull files from them. To get a file from a customer on Windows, ask them to send it.
* Transfers stop if the session ends or the connection drops. Send the file again once you are reconnected.

If a transfer fails, see [Troubleshooting](/troubleshooting/).

# Use the viewer

> Find your way around the viewer toolbar, switch between monitors, adjust quality and audio, and recover from dropped connections.

The viewer is the browser tab where you see and control the remote computer. It opens from **View** in **Sessions** or **Access**.

## The toolbar

[Section titled “The toolbar”](#the-toolbar)

From left to right, the toolbar shows the tools you are allowed to use in this session. A button you do not see is either not available on this computer or not in your role.

| Tool                               | What it does                                                                                                                                                                                                                                                       |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Session code and state             | The Support code (or session name) and the connection state. **View only** appears when you can watch but not control; its tooltip says **Not included in your plan: remote control. You can watch this session.** when your plan does not include remote control. |
| Monitor buttons and **Pop out**    | Switch monitors, or open another monitor in its own window. Shown with more than one monitor.                                                                                                                                                                      |
| **Backstage** / **Exit Backstage** | In a Backstage session, switch between the hidden desktop and the live screen. See [Work in Backstage](/use/backstage/).                                                                                                                                           |
| **Run as admin**                   | Relaunch Blink as administrator on a customer’s Windows computer. Reads **Admin** once it runs as administrator. See [Run as administrator](/use/run-as-administrator/).                                                                                           |
| **Install Access**                 | Install the unattended agent from a support session. See [Run a support session](/use/support-sessions/#turn-a-support-session-into-an-access-device).                                                                                                             |
| **Power**                          | Reboot an Access device, or reboot into Safe Mode. See [Reboot and Safe Mode](/use/reboot-and-safe-mode/).                                                                                                                                                         |
| **Terminal**                       | Open a command window, recorded when your plan includes terminal history. See [Open a remote terminal](/use/remote-terminal/).                                                                                                                                     |
| Quality                            | **auto**, **low**, **standard** or **high**.                                                                                                                                                                                                                       |
| Audio                              | Hear the computer’s sound, or mute it.                                                                                                                                                                                                                             |
| **Send file**                      | Send files to the computer. See [Transfer files](/use/transfer-files/).                                                                                                                                                                                            |
| **Type text**                      | Type text as keystrokes. See [Control the computer](/use/control-and-clipboard/#type-text).                                                                                                                                                                        |
| **Chat**                           | Open the chat panel on the right. A number on the button counts unread messages. See [Chat with the customer](/use/chat/).                                                                                                                                         |
| **Blink View**                     | See through the customer’s phone camera. Shown when your license includes Blink View and your role allows it. A dot means a phone is waiting for your answer. See [Blink View](/use/blink-view/).                                                                  |
| **Ctrl+Alt+Del**                   | Send Ctrl+Alt+Del. Access sessions only, not in Backstage.                                                                                                                                                                                                         |
| Clipboard indicator                | Shows when the clipboard is shared and flashes short status messages.                                                                                                                                                                                              |
| **Fullscreen**                     | Fill your screen with the viewer.                                                                                                                                                                                                                                  |
| **Log**                            | Open the session log in a new tab.                                                                                                                                                                                                                                 |
| **Reconnect**                      | Reload the viewer.                                                                                                                                                                                                                                                 |
| **End**                            | End the session for everyone.                                                                                                                                                                                                                                      |

At the bottom, a status strip shows the screen resolution, the agent version, the picture rate and connection statistics, and on the right whether the keyboard is captured.

## Multiple monitors

[Section titled “Multiple monitors”](#multiple-monitors)

When the remote computer has more than one monitor, the toolbar shows one numbered button per monitor and the label **monitor 1 of 2** (and so on).

* Select a number to show that monitor in this window.
* Select **Pop out** and choose a monitor to open it in its own window, sized to that monitor. Drag the window to another screen to watch two monitors side by side.

Each window is its own view, and each monitor you view is recorded when your plan includes session recording.

## Quality

[Section titled “Quality”](#quality)

Every session starts on **auto**, which adapts to the connection. Choose **low**, **standard** or **high** to override it. Your choice lasts until you close or reload the viewer.

## Audio

[Section titled “Audio”](#audio)

The computer’s sound plays in the viewer. Browsers block sound until you interact with the page, so audio starts with your first click or key press. Select the audio button to mute or unmute; this browser remembers your choice for the next session.

On a Mac, the customer must allow **Screen & System Audio Recording** before you can hear anything. Until then the button reads **Audio not allowed**.

If your plan does not include **Remote audio**, the button is greyed out and reads **No audio**, with the tooltip **Not included in your plan: remote audio**.

## Connection problems

[Section titled “Connection problems”](#connection-problems)

The viewer handles dropped connections on its own and tells you what is happening:

* **Reconnecting…** with **Lost connection to the server**: your browser lost the connection. The viewer retries and shows the countdown.
* A notice that the connection to the customer’s computer was lost: Blink waits up to 2 minutes for the computer to come back. If it does not, the session ends with **The customer’s computer did not come back within 2 minutes.**
* **This page is out of date**: Blink was updated. Select **Reload**.
* **No access to this session** or **Access revoked**: your role no longer allows this session. Ask an administrator.
* **Session ended**: the session is over. You can close the window.

**Reconnect** in the toolbar reloads the viewer at any time without ending the session. If problems persist, see [Troubleshooting](/troubleshooting/).

## Several technicians

[Section titled “Several technicians”](#several-technicians)

More than one technician can be in a session at once, each in their own viewer. The customer’s banner (or the Mac menu bar item) names everyone viewing. Each technician’s tools follow their own role, and **End** ends the session for all of them. When a customer shares their phone camera with [Blink View](/use/blink-view/), everyone in the session sees the camera tile.

# What your customer sees

> The join page, the support tool, the on-screen banner and the chat window from the customer's side, on Windows and on a Mac.

This page walks through a support session from the customer’s chair, so you can guide them over the phone. Share it with customers who want to know what to expect.

## The join page

[Section titled “The join page”](#the-join-page)

The customer opens your join page (your Blink address followed by `/join`) and sees **Join a support session** with one field for the code.

1. They type the code you gave them.
2. They select **Download the support tool**.
3. The page says **Your download has started** and shows the next steps for their computer.

If something is wrong with the code, the page says so:

| Message                                                                    | What to do                                                                                                                                                    |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| That code was not found or has expired. Ask your technician for a new one. | Create a new code. Each code works once and expires on its own. See also [Fix a Support code that does not work](/troubleshooting/support-code-not-working/). |
| Too many tries. Wait a few minutes, then enter the code again.             | Wait a few minutes, then try again.                                                                                                                           |
| Could not reach the server. Check your connection and try again.           | The customer’s internet connection or network is blocking the page.                                                                                           |

On an iPad the page shows **Use a computer** instead: support works on a Windows PC or a Mac.

The page also tells the customer three things: a banner stays on screen while the session is live, each code works once, and closing the tool ends the session with nothing left installed.

## On Windows

[Section titled “On Windows”](#on-windows)

### Start the tool

[Section titled “Start the tool”](#start-the-tool)

1. Open the downloaded file from the browser’s downloads.
2. If Windows shows a warning, choose **More info**, then **Run anyway**.
3. Keep the tool running while the technician works.

A small Blink window shows the connection status while it connects. If the tool ever asks for a code, the customer types the same code and selects **Connect**.

### The banner

[Section titled “The banner”](#the-banner)

While a technician is viewing a screen, a banner sits at the top of that screen. It reads **Viewed by technician:** followed by the technician’s name (or **Viewed by a technician**, or the number of technicians when several are watching). The name shown is set by your administrator (see [Choose the name customers see](/configure/technician-name/)).

The banner has:

* A blinking **Recording** indicator, only when the session is recorded. Without it, the session is not recorded.
* **Chat**: opens the chat with the technician, when chat is available in this session. A dot on it means an unread message. See [Chat with your technician](#chat-with-your-technician).
* **Send file**: sends a file to the technician (see [Transfer files](/use/transfer-files/)). It is not shown once Blink runs as administrator.
* **End**: ends the session.
* **Hide**: hides the banners.

The customer can drag a banner out of the way. With several monitors, each monitor a technician is viewing gets its own banner. The banner is part of the picture you see in the viewer and in the recording (when the session is recorded), so you see exactly what the customer sees.

**Hide** takes every banner down. They come back when another technician joins, or when the customer clicks the tray icon.

### The tray icon

[Section titled “The tray icon”](#the-tray-icon)

A Blink icon stays in the notification area for the whole session, even while nobody is viewing. Its tooltip says whether a technician is viewing, and shows **recording** when the session is recorded.

* Left-click shows the banners again.
* Right-click opens a menu with **Show banner**, **Chat with technician** (**Chat with technician (new message)** when a message is unread), **Send file to technician…**, **Stop sending** (while a file is going out), **Close command windows** (while a technician has a terminal open) and **Exit**.

### Files and command windows

[Section titled “Files and command windows”](#files-and-command-windows)

* Files a technician sends land in the **Blink** folder inside the customer’s **Downloads** folder, and the customer gets a **File received** notification.
* When a technician opens a command window (terminal), the banner on the main monitor shows who opened it, together with a **Close command windows** button. That banner stays up while the terminal is open, even if the customer hid the banners.

### Admin prompts

[Section titled “Admin prompts”](#admin-prompts)

If the technician needs administrator rights, the customer sees a Windows prompt asking to allow Blink to make changes and clicks **Yes**. See [Run as administrator](/use/run-as-administrator/).

## On a Mac

[Section titled “On a Mac”](#on-a-mac)

### Start the app

[Section titled “Start the app”](#start-the-app)

1. Open the downloaded Blink app from **Downloads**. Safari unzips it automatically; in other browsers, double-click the zip first.
2. If macOS won’t open it, go to **System Settings** › **Privacy & Security** and choose **Open Anyway**.
3. When macOS asks, allow **Screen Recording** and **Accessibility** for Blink.

### Permissions

[Section titled “Permissions”](#permissions)

macOS blocks screen sharing and remote control until the customer allows them. Blink shows a window titled **Your technician needs permission to see your screen** with two lists:

* **Screen & System Audio Recording**: so the technician can see and hear the screen.
* **Accessibility**: so the technician can use the mouse and keyboard.

Each has an **Open Settings** button that goes straight to the right place in System Settings. The customer turns Blink on in each list. After allowing Screen Recording, macOS asks to restart the app; the customer clicks **Quit & Reopen** (or **Restart Blink**) and the session carries on.

While permissions are missing, your viewer tells you which ones and offers **Ask the customer again**, which shows the permission window on their screen again.

Tip

If the switch is already on but Blink still says it is not allowed, an older Blink entry is in the list. Select it, remove it with the **−** button, then open Blink again and allow it when asked.

### The menu bar

[Section titled “The menu bar”](#the-menu-bar)

The Mac app has no banner. Instead, Blink shows in the menu bar while the session is live, saying who is viewing (or **Waiting for the technician**). Its menu has **Chat with technician…**, **End session**, and **Close command windows** while a technician has a terminal open. A small panel also appears while a terminal is open.

Files a technician sends land in **Downloads** › **Blink**, with a **File received** notification. Sending files to the technician from a Mac is not available.

## Chat with your technician

[Section titled “Chat with your technician”](#chat-with-your-technician)

Your technician can write to you in a chat window while they help you. In a Support session you can also open the chat yourself.

Chat is part of some Blink plans. When it is not available, the **Chat** button, the tray menu item and the Mac menu item do not appear.

### Open the chat

[Section titled “Open the chat”](#open-the-chat)

* **Windows**: select **Chat** on the banner, or **Chat with technician** in the tray icon menu.
* **Mac**: choose **Chat with technician…** in the Blink menu bar item.

The window is titled **Chat with** and the technician’s name (or **Chat with your technician**). The band at the top shows the technician’s initials and name. Until the first message it says **Messages from your technician appear here.**

To write, type in **Message** and press Enter (on Windows, Shift+Enter starts a new line), or select **Send**. **Seen** appears once the technician has read your message, and a line shows when the technician is typing.

### When a message arrives

[Section titled “When a message arrives”](#when-a-message-arrives)

The chat window never takes over what you are doing:

* **Windows**: the window appears without taking the keyboard focus, and its taskbar button flashes. The **Chat** button on the banner shows a dot, and the tray menu says **Chat with technician (new message)**.
* **Mac**: the chat panel comes to the front and the Blink icon in the Dock bounces once. The Blink menu bar item shows a dot, and its menu says **Chat with technician (new message)…**.

Closing the window does not end the chat or the session. Open it again from the banner, the tray icon or the menu bar.

### Secret messages

[Section titled “Secret messages”](#secret-messages)

Your technician may send you something private, such as a password, as a secret message. It arrives as a card titled **Secret message from** and the technician’s name, with the time left before it expires.

1. Select **Reveal**. The text shows for 30 seconds.
2. Select **Copy** to copy it, or **Hide** when you are done.

After that the secret is gone, and the chat shows it as viewed. If you do not open it in time, it expires.

The technician cannot see the secret on your screen: in their view and in the recording, a grey block covers it. They also cannot reveal it for you with their remote mouse. On Windows, a copied secret stays out of the clipboard history, and it is never passed to the technician’s clipboard.

To send your technician a secret, select **Secret…**, type it in the **Secret message for your technician** box (it is hidden as you type) and select **Send**. **Cancel** goes back. The chat then shows **Secret message sent**. Your technician can open it once, and it expires if they do not.

### When the chat ends

[Section titled “When the chat ends”](#when-the-chat-ends)

The chat closes with the session: the window says **The session ended. This chat is closed.** A computer your organization manages with Blink Access can show the chat window too, when a technician writes to you before or during a session; you can answer, but only the technician can start that chat.

## If your technician asks to see through your phone

[Section titled “If your technician asks to see through your phone”](#if-your-technician-asks-to-see-through-your-phone)

With Blink View, the technician can see through the customer’s phone camera. The phone needs no app:

* The customer opens **view\.blink.izt.app** on the phone and enters the code you give them, or scans the QR code with the phone’s camera.
* The QR code may appear in a window on the customer’s computer titled **Scan this with your phone camera**. **Close** closes it; it also closes by itself once the phone joins.

Nothing is shared until a technician accepts the phone, and **End** on the phone stops it at any time. See [Blink View on the customer’s phone](/use/blink-view-phone/).

## How the customer ends the session

[Section titled “How the customer ends the session”](#how-the-customer-ends-the-session)

The customer is always in control:

* **Windows**: **End** on any banner, or **Exit** in the tray icon menu.
* **Mac**: **End session** in the Blink menu bar item.

The session ends for every technician, and its recording, if your plan includes session recording, is finalized. Nothing stays installed. Files the technician sent stay in the customer’s Downloads folder.