Skip to content
M.A.V.E.Ndocs

Settings → Security

The Security card lives in Settings (the gear in the sidebar footer → Security in the left rail). It is the one place that decides who may reach this M.A.V.E.N from another host and how much the paid engines may spend per day. The reasoning behind it is on Security & remote access; this page is the card itself.

Settings → Security - M.A.V.E.N

What it shows

Section titled “What it shows”

A status line at the top says whether this page is gated - the answer depends on how you reached it: localhost is never gated; a Tailscale or LAN name is.

PIN mode

Section titled “PIN mode”

Three radio choices:

  • Generated PIN for remote hosts (default) - loopback open; every other host asks for the PIN M.A.V.E.N generated at first boot (~/.maven/access-pin). Reveal shows it, Copy copies it, Regenerate makes a new one and signs every remote session out.
  • My own PIN, everywhere - type a PIN of 8+ characters; it is required on this machine too. Equivalent to MAVEN_ACCESS_PIN=<pin> in .env.local. Changing it signs every session out.
  • No PIN anywhere - MAVEN_ACCESS_PIN=off. Only the host/origin checks remain. Unknown hosts then get 421 instead of an unlock screen.

Allowed hosts

Section titled “Allowed hosts”

The MAVEN_ALLOWED_ORIGINS list as editable chips - host[:port] or a full origin. A host that unlocks with the correct PIN is added here automatically; this is where you review and remove them. An SSH tunnel arrives as localhost and needs no entry.

Daily spend ceiling

Section titled “Daily spend ceiling”

MAVEN_DAILY_SPEND_USD, default 25. Every paid engine - images, video, voice, 3D, upscales - refuses with HTTP 402 above it until local midnight. 0 removes the ceiling. The card shows what was spent today, from the same meter Telemetry reads.

How to use it

Section titled “How to use it”
  1. Open Settings → Security.
  2. Leave the mode on Generated PIN unless you want a PIN on this machine too.
  3. Click Reveal and note the PIN before you open M.A.V.E.N from a phone.
  4. Raise the ceiling on a heavy generation day; lower it for a shared machine.

Tips

Section titled “Tips”
  • Changes apply immediately; the matching .env.local lines are written for you.
  • Locked out after setting your own PIN? Remove MAVEN_ACCESS_PIN from .env.local and restart.

See also

Section titled “See also”