Hermes Webapp: Open Desktop In A Browser In 6 Steps (2026)

The Hermes webapp puts the whole Hermes Desktop workspace in an ordinary browser tab, served straight from the gateway on its own listener.

It shipped in Hermes Agent v0.22.6 on 2 November 2026, and it's off until you switch it on.

Below is the exact order I'd set it up in: the three commands, the config block, the sign-in flow, the Web Access pane for other devices, and the network traps that matter most.

If you'd rather my team map how this fits your own setup, book a free SEO strategy session and we'll walk through it with you.

What The Webapp Is, And What It Isn't

The Desktop docs describe it as the Desktop workspace served to a normal browser.

So you get sessions and profiles, Capabilities, Messaging and Artifacts, plus scheduled jobs, Git review, previews, the terminal rail and the file tree of the host.

The docs put it in bold: this is not the Web Dashboard.

The Web Dashboard is a separate admin panel you start with hermes dashboard, and it opens on http://127.0.0.1:9119.

Its job is settings, API keys, sessions, logs and analytics, plus an optional Chat tab that embeds the TUI through a pseudo-terminal.

The Webapp lives on a different port, comes from a different process and gives you a different interface.

Question	Webapp	Web Dashboard
How you open it	`hermes webapp`	`hermes dashboard`
Default address	`http://127.0.0.1:9120`	`http://127.0.0.1:9119`
Who serves it	The gateway, on its own listener	The dashboard web server
What you get	The full Desktop workspace	An admin panel for config, keys, sessions and logs
Config section	`webapp:`	`dashboard:`

Step 1: Get Onto v0.22.6 The Right Way

The v0.22.6 release notes split updating by install type.

CLI installs: run hermes update, or re-run the installer one-liner.
Docker and Hermes Cloud: pull nousresearch/hermes-agent:stable (or :latest).
Microsoft Store app: it updates through the Store.
The .exe or .dmg Desktop installer: no change in this release; it picks this up with the next bundled release.

That last line is the gotcha.

If you installed Desktop from the installer, the CLI side can be on v0.22.6 while your native app is still waiting for its bundled update.

The release notes also say the Webapp is "undocumented here on purpose", with full notes due in v0.23.0, so the Desktop and configuration docs are the reference for every step below.

Step 2: Turn It On With Three Commands

These are the exact commands from the docs.

hermes config set webapp.enabled true
hermes gateway restart
hermes webapp

The restart matters.

The configuration reference says the gateway reads webapp.enabled when it starts, so a config change without a restart does nothing.

hermes webapp then builds the bundle if it's out of date, starts the gateway if it isn't running, and opens a one-use sign-in link.

The first build can take a few minutes, so let it finish.

Step 3: Know The Four Webapp Settings

This is the full webapp: block with its defaults.

webapp:
  enabled: false     # true: the gateway serves the Webapp
  host: 127.0.0.1    # 127.0.0.1, ::1 or localhost; or 0.0.0.0 / :: for other machines (dashboard sign-in required)
  port: 9120         # fixed, so the browser's address stays the same across gateway restarts
  public_url: ""     # the https:// address a reverse proxy or tunnel serves the Webapp at (sign-in required)

I leave host alone on a single machine.

Any value other than 127.0.0.1, ::1, localhost, 0.0.0.0 or :: keeps the Webapp off, and that includes another loopback address such as 127.0.0.2.

The port stays fixed on purpose, so the address in your browser doesn't move after a gateway restart.

🔥 Want your agent workspace open on every screen you own? Inside the AI Profit Boardroom you get step-by-step video trainings, the installable Agent OS with Hermes set up, four coaching calls a week and 3,400+ members running agents day to day. → Join the AI Profit Boardroom

Step 4: Sign In With The One-Use Link

The link hermes webapp opens works once, within 60 seconds.

The browser trades it for a sign-in held in that tab, which is why you stay signed in through a reload or even a gateway restart.

A fresh tab or a bare URL shows instructions rather than access, and the fix is to run hermes webapp again.

New Window, profile windows and session pop-outs hand the sign-in over with their own one-use links.

Each OS protects the link differently:

Linux: the gateway checks the browser's connection belongs to your OS user.
Windows: the link travels only in the browser launcher's command line, which other standard users can't read.
macOS, the BSDs and illumos: the command writes the link into a page only your OS user can read and opens that page instead.

Over SSH on a Mac, a browser can open on the Mac's own screen where you can't see it, so run hermes webapp --no-open to get the link.

Until a printed link is used, it signs a browser in as you, so never paste it into a chat or a ticket.

The Flags I Actually Use

The CLI reference lists six options for hermes webapp.

--status: shows whether the running gateway serves the Webapp, and at which address.
--no-open: prints the link (or, behind the sign-in gate, the address) instead of opening a browser.
--sign-out: signs out every browser at once and reports how many connections closed.
--build-only: builds the bundle and stops.
--force-build: rebuilds even when the build receipt is current.
--skip-build: uses the existing apps/desktop/dist-webapp as is.

Want a named profile? Run hermes -p work webapp and the Webapp opens on the work profile.

Profiles the default gateway serves share its Webapp, while a standalone profile's own gateway serves its own once its config turns it on.

Step 5: Open It On Another Device With Web Access

In the native app, Settings → Web Access opens the Webapp up to your other devices, gated by a sign-in with your Nous account (Providers → Accounts).

Only the native app on its local connection shows this pane, and a browser signed in over the network can't change it.

You get two choices, per the Web Access section of the docs.

This network: devices on the same Wi-Fi open http://<this computer's address>:<port>. It's plain HTTP, so the traffic isn't encrypted and others on that network could read it. Stick to networks you trust.
My own URL: point it at an HTTPS address that's already running for you (Tailscale Serve, a tunnel or a reverse proxy) that forwards to http://127.0.0.1:<port>. It's saved as webapp.public_url.

The docs are blunt about one thing: never forward that port from your router directly.

Start does four things: it builds the Webapp if it isn't built yet, updates your Nous account with the sign-in address if that address has changed, writes the webapp: settings, then gives the gateway a restart.

If a chat is running, the gateway refuses to restart, the pane shows Restart needed, and Restart gateway finishes the job once the chat ends.

Stop turns it off the same way.

Step 6: Put It Behind Your Own URL

If you skip the pane and wire it by hand, keep host on loopback and set webapp.public_url to the address your proxy or tunnel serves.

Setting public_url turns on dashboard sign-in even on a loopback host.

It also becomes the one outside hostname the Webapp accepts requests for, and sign-in callbacks are built on it, so think of it as the Webapp's single trusted origin.

The value must be an http:// or https:// address with no credentials, query or fragment, or the Webapp stays off.

The other route is webapp.host: 0.0.0.0, which also requires the dashboard sign-in gate.

The docs pair username and password with a trusted LAN or VPN, and OAuth/OIDC with anything internet-facing.

Behind the gate, hermes webapp opens the Webapp's address instead of a one-use link, and you sign in with your dashboard account.

One more config trap: dashboard.public_url belongs to hermes dashboard and never applies to the Webapp.

📞 Want someone to sanity-check your remote setup? Book a free SEO strategy session and my team will look at how your agents and sites fit together. → Book your free strategy session

The Security Rule I Never Skip

The docs carry a warning box titled "Treat Webapp access like access to Hermes on the host".

A signed-in Webapp user can run arbitrary commands as the OS account running Hermes, run agent tools, use host files and Git, and reach that account's environment and credentials.

So the rule is simple: don't expose it without a sign-in provider.

The docs prefer an SSH tunnel, Tailscale or another trusted VPN.

When you finish on a shared machine, run hermes webapp --sign-out.

What Plain HTTP Switches Off

Browsers disable features that need a secure context on a plain-HTTP address other than loopback.

On the Webapp that means the bot screen viewer, the microphone (dictation, live voice and the remote wake word), clipboard reading (terminal paste and pasting an image) and system notifications.

http://localhost and http://127.0.0.1 count as secure, so on the host itself nothing is lost.

To keep those features remotely, open the Webapp over HTTPS through webapp.public_url, or through an SSH tunnel to 127.0.0.1.

hermes webapp --status prints a note when the address a browser opens is plain HTTP on another host.

The Terminal Rail Limits Worth Knowing

The terminal in the Webapp opens the host's interactive shell as a child of the gateway, in your home folder unless terminal.cwd names another.

Files you drop on it upload to the host at up to 16 MiB each, and their paths get typed in.
A refresh or dropped connection detaches the terminal without ending its shell.
Detached shells are kept for 15 minutes while the gateway runs, up to 16 host terminals in all.
Reconnecting replays up to 1 MiB of recent output.
A gateway restart or update ends them.

Closing the terminal's tab ends the shell, while hiding it doesn't.

Desktop Plugins In A Browser Tab

The Webapp loads the desktop plugins installed on the host that serves it, from the desktop-plugins folder in that host's Hermes root.

A new or removed plugin folder shows up within seconds.

An edited plugin.js only loads on ⌘K → Reload desktop plugins, because a browser can't watch the host's files.

Capabilities → Plugins → Install works from the tab too, and the host installs exactly the commit the dialog showed you.

From a browser, the clone refuses plugin folders with symbolic links or over 64 MB, and a plugin's folder access (ctx.files) isn't available.

Desktop plugins aren't sandboxed, so load only ones you wrote or reviewed, and lean on the catalog trust model for catalog installs.

If you're picking plugins to try, start with our list of the best Hermes Agent plugins.

Troubleshooting When The Page Won't Load

Run hermes webapp --status first.

When the gateway can't serve the Webapp, it still serves native clients and the status says why.

The port is taken.
Sign-in is required and no sign-in provider is set up.
The browser sign-in file webapp/session-token in the Hermes home can't be read or written.

Fix the cause, then run hermes gateway restart, since the gateway reads these settings at start.

If the port was taken, the gateway also replaces the Webapp's sign-in, so open tabs need a fresh hermes webapp.

An unbuilt bundle is the exception: hermes webapp builds it and the running gateway serves it with no restart.

Old chats that show history but won't continue need hermes sessions adopt once on the host.

What Still Needs The Native App

A few things remain Electron-only: the updater, launching an external terminal, inspecting OS windows, always-on-top overlays and global shortcuts.

Display preferences live in one ui-preferences.json per computer, so a theme change in the native app reaches Webapp tabs when they regain focus or within about ten seconds.

Everything else, including chats, runs on the same gateway as the CLI, the native Desktop and messaging, so every surface sees one conversation with one queue.

Want help putting your agent workspace to work on real projects? The AI Profit Boardroom walks through it step by step.

Also On Our Network

FAQ: Hermes Webapp

Which port does the Hermes Webapp use?

It defaults to port 9120 on 127.0.0.1. You can change it with webapp.port, and a standalone profile picks the first free port above 9120 when Web Access starts it.

Do I need to restart the gateway after turning it on?

Yes. The gateway reads webapp.enabled when it starts, so run hermes gateway restart after hermes config set webapp.enabled true.

Why does a new tab show instructions instead of my workspace?

The sign-in is kept per tab. A fresh tab or a bare URL needs a new one-use link, so run hermes webapp again.

Can I open the Webapp from my phone?

Yes. In the native app, Settings then Web Access lets you open it on your network over HTTP or on your own HTTPS URL, both behind Nous sign-in.

Does webapp.host 0.0.0.0 work without a login?

No. A 0.0.0.0 or :: host requires a dashboard sign-in provider, and without one the gateway serves native clients only.

📺 Video notes + links to the tools 👉

🎥 Learn how I make these videos 👉

🆓 Get a FREE AI Course + Community + 1,000 AI Agents 👉

About Julian

I'm Julian Goldie, an SEO entrepreneur, author and founder of the AI Profit Boardroom, which has 3,400+ members.

I help business owners scale with AI agents, automation and SEO.

I've built a 7-figure SEO and link building agency, Goldie Agency, with a team of 70+ SEO experts.
I've grown a YouTube channel to 400,000+ subscribers.
I wrote "Link Building Mastery".
My Udemy courses have taught over 29,000 students.

→ Get my best AI training inside the AI Profit Boardroom

Run the three commands tonight, check them with hermes webapp --status, and if you want my team to review how your agents fit your business, book a free strategy session and bring your Hermes webapp setup.