扫码配对
ACP v2.1 没有共享 token。每台设备有长期 X25519 身份，Hub 用白名单放行。二维码只是把「连谁、一次性登记码、指纹」一次交给 App。扫一次，这台机器上的全部实例都能用。
Pairing
ACP v2.1 has no shared token. Each device has a long-term X25519 identity; Hub allowlists it. The QR hands the app the endpoint, a one-time enrollment code, and a fingerprint. One scan authorizes every instance on that host.
怎么扫
How to pair
shepaw-hub pair # 或仪表盘「扫码配对」
打开 Shepaw，扫描终端或仪表盘里的二维码。手机和电脑要在同一 Wi-Fi。URI 是 shepaw://peer。
Open Shepaw and scan the QR from the terminal or dashboard. Phone and computer must share Wi-Fi. The URI is shepaw://peer.
二维码里有什么
What’s in the QR
- WebSocket 地址（局域网
ws://，外网可带 Channel） - 一次性 enrollment code（握手成功即作废）
- Fragment：
#fp=Hub 静态公钥指纹，可选pk=
- WebSocket URL (LAN
ws://, or Channel when off-site) - One-time enrollment code (consumed on handshake)
- Fragment:
#fp=Hub static-key fingerprint, optionalpk=
URL 里的 #fp= 必须和 Hub 真实公钥指纹一致，否则握手以 4403 关闭——这是为了防止中继替换身份。
The #fp= in the URL must match Hub’s real key fingerprint or the handshake closes with 4403 — that blocks a relay from swapping identity.
离开局域网
Off LAN
同一 Wi-Fi 不必开 Channel。出门时在 Hub 仪表盘「扫码配对」里展开「共享 Channel」，填 URL / Channel ID / Secret。保存后重新扫码，二维码会带上 channel=。也可以用 CLI：
Skip Channel on the same Wi-Fi. Away from home, expand Shared Channel under Pair device in the Hub dashboard, save URL / Channel ID / Secret, then scan again so the QR includes channel=. Or use the CLI:
shepaw-hub gateway-set-channel \ --server https://channel.shepaw.com \ --channel-id ch_xxx \ --secret <hmac-secret> shepaw-hub web --gateway shepaw-hub pair
手动配对
Manual pairing
扫不了码时，把 App 显示的设备公钥交给 Hub：
If you cannot scan, paste the device public key from the app into Hub:
shepaw-hub peers add <instance-id> <device-pubkey-base64> --label "My iPhone"
吊销一台丢失的手机
Revoke a lost phone
v2.1 里每台设备是白名单里的一行。删掉那一行即可，不必让其他设备重新配对。
In v2.1 each device is one allowlist row. Remove that row; other devices stay paired.
shepaw-hub peer-devices-remove <fingerprint>