There is no login. The pen drive is who you are.
An encrypted key file on a removable drive, whose private half only decrypts under your computer's own fingerprint, is what unlocks Lens. Touch ID stands behind it. Pull the drive and the console locks — a lock, not a logout: your shells and every running job survive underneath. There is no password to reuse and no account to phish.
The door, in order
The key
A stick small enough to leave with its owner. Drives over 128 GB and Time Machine disks are refused as keys, with no override: a drive nobody would carry to the bathroom is not a second factor.
Touch ID
Asked once the key is in and verified, never for a computer with nothing plugged in. A Mac with no sensor falls back to its password; the degraded state is always said on screen.
The map
Lens opens on your servers. Being logged in is the authentication: no Touch ID per action. Root on a box is your saved password through sudo, sealed under the drive.
The account is a key you paste once
A new account opens with the activation key from create-account, opened on your computer with the envelope Lens carries and LockFlare's signature checked locally. It is written onto the drive beside the identity and carries your free server licenses.
A server is a key for one address
A server license is issued for one IP address and carries it inside, signed. Adding a server is pasting the key; the address comes out of it. A key issued to another account is refused, so twenty accounts can never be pooled onto one map. The shell itself is never refused for a license.
Everything Lens keeps is sealed
Saved logins, certificates and their keys, repository secrets and API keys live on your computer under the drive's own signature. The file is useless to anyone who copies it.
Multiple keys, one drive per fleet
Several keys can live on one machine; a session pins to its key and other keys' servers are never listed. A colleague's drive opens their map, not yours.
For the days something goes wrong
Four ceremonies, each one page in Setup that is the documentation, with the button at the bottom.
The encrypted backup on the key
One file on the pen drive holding everything Lens has — the map, the boards, snippets, tunnels, templates, diagrams, clusters, the audit ledger, the certificate vault and the saved credentials — rewriting itself while the key is plugged. Sealed twice: under your passphrase, the path that works on a new machine, and under the drive's signature, so the automatic rewrite needs no passphrase. A fresh Lens with a verified key offers the restore at the door, before anything draws.
A travel copy for a second computer
A key is bound to the machine that made it. The travel copy is the same key pair, id and account license sealed under a passphrase, so a new computer enrols the same key — every server license still holds — and the backup brings the whole map back. Possession plus a secret instead of possession plus a machine; the trade-off is said on screen.
A duplicate for the drawer
A locked, full-screen ceremony makes a twin: the key read into memory under Touch ID while the source is plugged, so the screen can say unplug your key and mean it; the new stick watched for, written, read back, and only then called ready.
Recovery, the worst day
Key lost, no backup, computer gone. Recover takes the account's email, password and one of its server addresses, mails a six-digit code, and hands back a bundle: the account license and every server key as one string. Pasted at the door, everything comes back. Lens sends nothing; the visit is the browser's.
Removing a server, with its license
Remove permanently hands the remaining days back to the account as credit; Remove and add another moves the license and its time to a new address. Both finish on lockflare.com and the note waits in Setup until you press Done.
Start with a pen drive you already have
Any stick under 128 GB. Lens writes the key; you keep the stick.