Help center

Each page starts from what you see on screen: the exact message, or plain words for it. It gives the short answer first, then what to check, the likely causes with their fixes, and what to send support if the problem continues. If a page tells you to press Talk to a person, that button is in the support chat where it is switched on. Otherwise open Help in the app or dashboard, or email support@driftstack.io.

Account, plans and billing

Trials, plans, payment, team invites, two-factor sign-in, legal terms and account deletion.

Accepting a team invite: link expired, need to sign in first — Sign up (or sign in) to the dashboard with the exact email address the invite was sent to, then open the link from the invite email.
'Account is suspended' — Sign-in is refused with "Account is suspended." (HTTP 403) when the account has been suspended or has been closed.
AI credits used up (monthly refresh, debt, task too large) — Your account funds AI turns from credits, and the balance cannot cover the next turn.
'AI isn't included on this account's current plan' — The account's plan has no AI agent at all, so AI is refused on every source — including your own provider key.
Your own AI provider key: required, rejected, or not allowed on this plan — Three different messages, three causes: the turn has no key it can run on (HTTP 502 BYOK … key required), the key you gave was rejected by the provider (same 502 with…
API keys are not included on this plan (Free desktop credential) — Every current plan and the Trial include the API; only the earlier Free plan, now retired, was desktop-only and could not create API keys.
Cannot create an API key until the owner accepts updated legal terms — Creating an API key is blocked (HTTP 409 legal-acceptance-required) while the account owner has not accepted a new version of one or more legal documents that needs acceptance, or a document it never accepted.
API key not recognised, revoked, or expired (401) — A 401 means the key itself was refused: not recognised, revoked (someone pressed Revoke), or expired (its expiry date passed, or a rotation's grace period of up to 24 hours ended).
Create, rotate and revoke API keys — Keys are made on the dashboard's API keys page: press New key, name it, pick a permission, and copy the key from "Key created — copy it now" — it is shown only once.
Bundled AI: opt-in consent and monthly cap (legacy API plans) — Bundled AI lets an account on the earlier API Builder or API Scale plans, or on Enterprise, run the AI agent without a provider key of its own.
Cancel your subscription: what happens at the end of the period — Cancelling is self-serve: dashboard → Billing → Cancel in … portal, which opens the billing portal, then choose Cancel plan there to finish.
Subscribe with a card (checkout, portal, invoices) — To subscribe, open dashboard → Billing → Choose a plan, pick Monthly or Yearly, and press Choose Starter, Pro or Team.
Crypto order stuck pending, partial, failed, or sent on the wrong network — Find the order's state under Billing → Crypto payments: pending means the payment is not complete yet (a short payment still on the payment page stays pending), partial means too little arrived, failed means reported failed or expired (including a short payment whose rest did not arrive before the payment page expired), or still unpaid 24 hours after it was created, or a part-paid order whose rest did not arrive within 3 days.
'Do this in the Driftstack dashboard' (API key cannot) — Some actions are done by a signed-in person in the dashboard and are refused to every API key, desktop credential and OAuth token with 403 dashboard-only.
Where data is stored; choosing a region — Customer data in our databases is stored in the EU today; file objects — avatars, stored profile state and the archive of session events older than 90 days — can replicate outside it, sessions run on Macs in the US or the Netherlands, and the region setting is a preference only.
Delete my account / data subject request (a person performs it) — There is no self-serve delete button.
'Not permitted with a device-provisioned key. Use a dashboard session.' — The credential the desktop app gets from "Sign in with browser" runs sessions and profiles, but is deliberately barred from account-takeover-style actions…
Which emails Driftstack sends and how to turn them off — Dashboard → Settings → Email notifications has six optional emails (seven once AI credits are switched on for the service) you can switch off; security and billing emails are always sent.
No hour limit under fair use (paid plans) — Session hours are not metered on any current paid plan: there is no monthly hours allowance, and you pay the plan price, not an hourly rate. Each session runs for a set time, and you can start the next one whenever you like. The free trial is the exception.
Where to find invoices, receipts and what you were billed — Card invoices and receipts live in the billing portal: dashboard → Billing → Manage in … portal.
Older plans (Personal, Team, Agency, API Starter/Builder/Scale) stay valid but are not sold again; Free accounts moved to the Trial — The plans sold before the 2026-09 catalog keep their limits for the accounts that hold them but are not sold again. Accounts that held Free moved to the Trial on 2026-10-02.
Review and accept updated Terms / Privacy / DPA / AUP — When a legal document (Terms of Service, Privacy Policy, Data Processing Agreement, Acceptable Use Policy) gets a new version that asks for acceptance (for the Privacy Policy: a confirmation that you have read it), the account owner must accept it before a new API key can be created.
Lost my authenticator app or recovery codes — If you still have either your authenticator app or an unused recovery code, you can get in and fix things yourself.
'Confirm this action with a fresh authenticator code' — Some sensitive actions require that you proved two-factor recently — within a 15-minute window by default.
Pay with crypto — Pay with crypto from Choose a plan in the dashboard: each crypto payment covers one month of the plan you choose. Enterprise pays as set in its contract.
Payment failed: sessions and AI stop until it is paid — When a renewal payment fails, new sessions and AI stop at once, with no grace period. Pay the open invoice or update your card and everything comes back by itself.
Enterprise: custom terms, annual contract — Enterprise is for larger teams that need more capacity, an uptime commitment and a named contact.
Pro plan: price and limits — Pro is for small teams and scripts running a few sessions in parallel: $249 a month or $2,490 a year, three sessions at once, 100 saved profiles and 100 saved proxies.
Scale plan: limits, and why it is not self-serve yet — Scale is a real, fully defined plan but it is not sold through self-serve checkout yet, because running 12 sessions at once needs more capacity than exists today.
Starter plan: price and limits — Starter is the plan for one person working alone: $90 a month or $900 a year, one profile running at a time, 25 saved profiles and 25 saved proxies.
Team plan: price and limits — Team is for teams running several sessions in parallel: $490 a month or $4,900 a year, six sessions at once, 300 saved profiles and 300 saved proxies, priority email support.
What 'sessions at once' (concurrent sessions) means — "Sessions at once" is how many of your profiles can have a session open at the same time — think of browser tabs open at once.
Too many requests (429) and Retry-After — A 429 with a Retry-After header means one of your account's request buckets is empty for the moment; wait the number of seconds given and send again — the SDKs do this for you.
Can I get a refund? (a person handles it) — A person handles every refund under the published refund policy; where the policy gives you a choice, you make it.
Tax / VAT on invoices — Prices are in US dollars, plus VAT or sales tax where it applies.
Team invite limits: 20 pending, 10-minute resend cooldown, 7-day expiry — Three limits protect the invite flow: an invite link lasts 7 days; re-inviting the same address within 10 minutes of the last email is refused and sends nothing — the link already…
Inviting teammates is available on paid plans — Teammates are a paid-plan feature.
'Your team role is read-only' (keys, saved tasks, profiles need admin) — In a team owner's workspace a member can look but not change: creating, rotating or revoking API keys, writing profiles, and every saved-task action need the admin role.
Working in a team owner's workspace (roles, what a member sees) — A team is one owner account plus the members who accepted an invite; the dashboard's Acting as picker switches between your own account and each owner team.
Unsubscribed trial: phone profiles move to the Trash after 30 days (warning email first) — If your trial ended and you have not chosen a plan, everything is kept for 30 days; then your phone profiles move to the Trash.
Free trial has ended: sessions refused until you choose a plan — Your 7-day free trial is over, so new sessions are refused until you choose a plan.
How the free trial works and what it includes — A new account starts on a 7-day Trial with no card required.
Two-factor sign-in paused after too many incorrect codes — Nothing is permanently locked — wait the minutes the message names.
Set up two-factor authentication (authenticator app, recovery codes) — In the web dashboard, open Security → Two-factor authentication → Set up two-factor authentication.
Change plan: upgrades take effect now and are prorated, downgrades at renewal — Change plan any time from dashboard → Billing → Change plan, then press Upgrade to … or Downgrade to … (Choose a plan if you have no card plan; Renew with crypto on a crypto-paid plan).
Reading the Usage page (current period, daily series, limits) — Usage shows activity counts for the current calendar month (UTC), a daily chart and the request limits for your account; none of the counts is billed.
Webhook endpoints: create, test, signing secret, retries — Dashboard → Webhooks: create an endpoint with an https URL and at least one event, copy the signing secret (shown once), then press Send test to confirm your server receives it.

App setup, sign-in and getting help

Installing and updating the desktop app, signing in, emails that did not arrive, moving a computer's data to your account, and how to reach support.

Move: duplicates kept, 'On your account, not on this computer', tags won't fit (200) — Nothing is deleted from your account unless you choose Delete or keep only one copy; only exact duplicates (same address and same secret) are merged on their own.
First sign-in after update: 'Move this computer's data to your account' — Saved proxies now live on your account rather than on one computer, so the same list appears wherever you sign in.
Move asks to re-type a proxy password / passwords differ — Two situations make the move stop on a proxy's password.
Move as a team member: settings shown then removed from this computer — If you're a member (not the owner or an admin) of the team workspace you're moving into, your local profile settings can't change the team's; the move shows the differences so you…
'Your browser is blocking site storage' during sign-in or sign-up — The dashboard keeps your sign-in in the browser's site storage.
'Couldn't reach Driftstack' / Offline pill / server not answering — The pill in the app shows the last connection check: green Server reachable, amber Connecting… or Server busy, red Server unreachable.
'Couldn't copy — clipboard blocked' — The app tried to write to your clipboard and the system refused, so it tells you instead of letting you assume the copy worked.
'Your sign-in has expired. Sign in again' (dashboard) — The dashboard shows this whenever the server answers a request with 401 or 403.
Desktop app: 'This API key wasn't accepted' / sign-in not accepted — The server refused the key or sign-in the app holds.
Download and install the desktop app (macOS, Windows, Linux) — The desktop app supports macOS, Windows and Linux and is a free download, from the Driftstack download page that every Download button on the website opens.
Uninstall or reinstall the desktop app: what stays on your account — Removing the desktop app deletes nothing on your Driftstack account. Sign out first, so its sign-in leaves the computer with it.
Desktop app first run: sign in with the browser (or paste an API key) — There is no license key to buy or find.
App can't use the computer's secure storage (setup wizard every launch, key not saved) — The app keeps its API key (your sign-in) in the computer's secure credential store (on a Mac, the Keychain), never in a plain file.
Desktop app signed me out: 'Your sign-in was revoked' / 'no longer valid' — When the server refuses the app's saved sign-in with a definite "revoked" or "invalid" answer, the app signs itself out once and shows a notice: "Your sign-in was revoked — sign…
Update couldn't be installed / app couldn't restart / move to Applications — The app installs updates on its own unless a session is running. When an install fails, it is usually because the app is not running from Applications.
'Please update Driftstack to keep editing' (old desktop build refused) — Your copy of the desktop app is older than the version the service now requires, so saves and launches from it are refused with "Please update Driftstack to keep editing." (HTTP…
Didn't get the verification, sign-in, reset or invite email — Every account email comes from noreply@driftstack.dev.
'An account with this email already exists' — That email address already has a Driftstack account, so signup refuses to create a second one.
Email support: replies by email; reports and reference numbers — Write to support@driftstack.io.
'Couldn't save the export — check the app's file-access permission' — The app could not write the export file where you chose.
'This feature is not available on this deployment' (503) — A 503 of type feature-unavailable means the thing you asked for is switched off where this server runs — not that the service is down.
Forgot password or reset link problems — Use Forgot password on the sign-in page.
'This Free desktop credential cannot access this API route' — On the earlier Free plan the desktop app's own API key reached only the routes the app itself uses; anywhere else the request was refused with HTTP 403 and this sentence. Every current plan and the Trial include the API.
Help: start a conversation and get replies in the app, the dashboard or by email — Open Help in the desktop app or the dashboard and start a conversation: a subject (optional) and a message of up to 8,000 characters.
Help limits: 3 open conversations, 5 an hour, 30 messages a day — Help accepts at most 3 open conversations per account, 5 new conversations an hour, 30 messages a day, and one new conversation every 10 seconds.
Help: 'Verify your email address first, then try again' — Starting a Help conversation needs a verified email address, because a copy of every reply goes to that address.
'The item changed or is busy. Refresh and try again' (409) / not found (404) — A 409 means the item you acted on is in a state that does not allow the action right now; a 404 means it is not there under your account any more.
A cloud key does not work on a self-hosted server, or the other way round — An API key only works on the server it was created on: a cloud key is refused by a self-hosted server and a self-hosted key by cloud.
'The service is temporarily unavailable' (500/502/503) and the status page — "The service is temporarily unavailable. Try again shortly." is what the desktop app and the dashboard say for any 500-range answer from the server.
Email or password not accepted — The server answered "Email or password is incorrect"; the dashboard shows it as "The email or password was not accepted".
'Too many incorrect passwords': sign-in paused — After 10 wrong passwords for one email address within 15 minutes, password sign-in for that address is paused for 15 minutes.
Sign in with an email link (magic link): invalid, expired or already used — A magic link is a single-use sign-in token that expires after 60 minutes; requesting a new one does not cancel the old one: each works until it expires, and using any one retires the rest.
Sign in or sign up with Google or GitHub (cancelled, stale page, HTTPS only) — The Google/GitHub buttons open the provider, then return you to Driftstack's callback page, which finishes the sign-in in the same browser window that started it.
What 'Sign out on this computer' removes and keeps — Signing out removes the app's copy of your account from this computer only.
Sign up and confirm your email (link, resend) — After you sign up, Driftstack emails you a single-use verification link; if opening it does not confirm you, paste the link on the verify page.
'Some information was not accepted' (400 validation) — The server checked what you sent and at least one field did not fit; nothing was saved or started.
Assistant limits: off-topic, conversation length, too many messages, unavailable — Where the assistant is switched on (it can be off on a deployment), when it can't answer it says why with a fixed sentence.
'Talk to a person': hand a chat to support (signed in vs not) — Press Talk to a person in the chat, add a message (up to 2,000 characters) and choose whether to include the transcript.
Assistant not configured: email support instead — On a deployment where the assistant isn't wired up, its routes answer "The support assistant is not configured on this deployment.
The Driftstack assistant: what it can and cannot do — Where it is switched on, the chat in the corner of the website, docs and dashboard is an AI.
Assistant limits for visitors and signed-in customers; API keys cannot use it — Where the assistant is switched on (it can be off on a deployment), anyone can use it as a visitor, behind a browser check, with lower limits and no account facts.
What is Driftstack? The desktop app, the dashboard, the API and SDKs, and the AI agent — Driftstack gives you real browsers built from Apple’s own WebKit, running on Macs in the cloud and set up so websites see iPhone Safari. You drive them by hand in the desktop app, from code, or with the AI agent.

Proxies, VPN and network

Adding SOCKS5, OpenVPN and WireGuard proxies, what each test result means, and why a session refused a proxy.

Add an OpenVPN (.ovpn) or WireGuard (wg0.conf) proxy — Open Proxies and press New proxy, choose Type OpenVPN or WireGuard, then paste the whole .ovpn or wg0.conf into the box or use Upload a .ovpn file / Upload a wg0.conf file.
Add and save a SOCKS5 proxy in the desktop app — Open Proxies and press New proxy, choose Type SOCKS5, give it a label, fill Host, Port and (if the provider gave them) Username and Password, then press Add proxy in the form.
Use one proxy for several profiles (Assign to profiles) — In the Proxies tab, open a proxy's Assign to profiles… ("Use this proxy for profiles you choose"), tick the profiles, and press Use for N profiles.
HTTP proxies can be saved but not used for a session — You can save and manage an HTTP proxy, but it cannot carry a session on this deployment.
.ovpn refused or 'Proxy config was rejected': unsupported lines / script-security — Driftstack never runs scripts from a VPN config, so a .ovpn with a script line (up, down, route-up, plugin…) is refused and the message names the line.
.ovpn references an external ca/cert/key file (must be inline) — Only the .ovpn text itself is sent to the session, so a line like ca ca.crt, cert client.crt, key client.key, tls-auth ta.key or tls-crypt … that points at a separate file cannot work; paste the certificate or key inline instead.
'Proxies are not configured' / 'VPN proxies are not available on this installation' — These messages come from the installation itself, not from your account or your proxy.
'This proxy changed since you last loaded it' / folders and tags changed elsewhere — Proxies live on your account, so another computer, a teammate, or a script using your key can change one between the moment you loaded it and the moment you save.
Stored proxy configuration could not be used, nothing was dialled — Driftstack could not turn this proxy's saved configuration into something it could connect with, so it never tried to connect.
Where proxy passwords are stored (encrypted, never shown again) — Proxy secrets are write-only.
Profile shows 'proxy deleted — choose another' and will not launch — When a proxy is deleted, every profile that used it is detached: it shows "proxy deleted — choose another" and refuses to launch until you pick a proxy.
Proxy works on my computer but 'fails from Driftstack' — Your profiles run on Driftstack's servers, not on your computer.
IP-allowlist proxies do not work: use a username and password — IP-allowlist access does not work with Driftstack.
Proxy limit reached: delete a proxy or upgrade — Each plan caps how many proxies the account can hold. Every paid plan gets as many saved proxies as saved profiles; the free trial keeps more proxies than profiles.
Proxy host must be a public internet address — A proxy is refused at save time if its address is private, loopback, link-local or a cloud-metadata address.
Session refused: choose one of your saved proxies (proxy_required) — Every session runs through a proxy you saved and chose — Driftstack has no connection of its own to run a session on.
Proxy test says 'Driftstack was busy; try again in a minute' — This is not a result about your proxy — nothing was measured.
Proxy test: quick check vs full check — A proxy test answers one question: would a session through this proxy work right now?
What the UDP / QUIC / HTTP/3 chips on a proxy mean — The chips say whether UDP traffic, and HTTP/3 (QUIC) on top of it, get through this proxy.
Proxy rejected the username and password — The proxy answered, then refused the username or password Driftstack sent.
Proxy connects but cannot reach the internet (egress_blocked) — Driftstack connected to the proxy and logged in, but the proxy then refused or failed to reach the destination.
Proxy was too slow to respond (timeout) — The proxy accepted the connection but did not finish in time.
Proxy could not be reached (host/port/online) — Before a session starts, Driftstack makes a real connection through your proxy.
Only the team owner and admins can launch through the team's proxies — In a team workspace, a team member can only see the team's proxies by name — not their address, username, or whether a password is stored — and cannot launch through them.
To change a VPN password or server address, paste the full config again — A VPN proxy's password and its server address live inside its configuration (the remote line of a .ovpn, the Endpoint of a wg0.conf), and they are stored together with the keys.
OpenVPN/WireGuard not included on this plan (trial/free) — OpenVPN and WireGuard proxies need a paid plan.
Session ended: VPN tunnel did not finish connecting / handshake failed — The session ended because the VPN never came up.
wg0.conf not accepted (incomplete, bad PresharedKey, private endpoint) — Paste the whole wg0.conf into the WireGuard box (or upload the file); the app fills the keys, endpoint and allowed IPs from it.

Sessions, profiles and the session window

Launching and stopping sessions, profiles and devices, the live view, cookies and uploads, and the AI agent.

The AI agent paused to ask you, or a site check paused the session — The agent stops for one of three reasons: it needs an answer from you, the next step has consequences and the purchase check on your account holds it until you approve it, or the page showed a…
AI chat cannot start: choose a proxy / none of your proxies can carry a chat — Every AI chat runs in a session, and every session goes out through a proxy you chose — the app never picks one for you.
'Still finishing the previous task': Send is held — Send is held for a moment while the AI view catches up: either it is reattaching to a session that was already running, or the task you stopped is still finishing on the server.
AI step failed: couldn't find it on the page / screenshot failed — When a step fails, the AI view shows a card with a plain headline and, where it makes sense, a suggested next instruction.
'3 AI tasks are already running' (AI task limit) — At most 3 AI tasks can run at the same time across all of your sessions.
'This session stopped answering automated steps' (session_unresponsive) — The session had already failed to answer a step, and a quick check just before the next step got no answer either, so nothing more was sent. The live view may still show the page. End the session and launch a new one.
Concurrent session limit reached (429 concurrency-limit) — Your plan allows a fixed number of sessions open at the same time, and you already have that many.
Import or export cookies for a profile — Cookies are imported and exported from the session window's cookies pane while a session on the profile is running: Export saves the jar as JSON; Import reads a cookies.txt or JSON cookie file whose cookies name their site.
Cookie jar too large for this session (413) — The cookie file is bigger than the browser running this session can accept in one go, so nothing was imported.
Create a profile and pick a device — A profile is a saved iPhone Safari identity: a name, one device (iPhone model + iOS + Safari), and the proxy it launches through.
What happens to a deleted profile (trash, restore, purge) — Deleting a profile moves it to a recycle bin (Trash).
Which iPhone devices a plan can choose — Every paid plan can choose any device open for new profiles; the Trial includes the iPhone 13 and iPhone 13 mini, and a new trial profile uses the iPhone 13.
Profile's device is 'On hold' and cannot launch — Some device profiles (a specific iPhone model, iOS and Safari version) are shown in the picker but temporarily not offered, because they are still being checked against a real…
Uploaded file is empty or too large for the session — A file you send into a session travels to the session in one message, so each session has a per-file limit — often around 2.9 MiB, and never more than 64 MiB.
Launch a session from a profile (what must be true first) — A profile launches when: you are signed in and online; the profile has one of your saved proxies chosen (the app never picks one for you); its device is not on hold; you are under…
Black screen: the live view connected but no video arrived — The window reached the streaming server but no picture came through.
Manual, Agent and Pair modes; 'another client is taking over' — A session runs in one of three modes.
'No Mac was free to start this session' — None of the Macs that run sessions could take a new one at that moment, so your session was closed before it started.
After a downgrade only the most recently used profiles and proxies can launch — If your account holds more saved profiles (or proxies) than your current plan includes, nothing is deleted, but only the most recently used ones — up to the plan's number — can…
Page didn't load in the session (proxy slow, DNS, 403/404/429, TLS) — The page failed to load inside the session.
'Profile already in use': its other live session has to end first — A profile can run in only one session at a time.
Export and import profiles (API only) — Export and import are API-only today: export writes a profile to a JSON file that holds its name, device, description and notes — not its cookies, logins or proxy — and import creates a fresh profile from that file.
Cannot create a profile: plan's saved-profile limit reached — Each plan includes a fixed number of saved profiles, and you have reached it.
Couldn't save the note or profile edit: check your connection — The edit did not reach your account, usually because the connection dropped for a moment.
Restoring a snapshot counts as a profile (limit) — A snapshot is a frozen record of a profile's device, name and description, and keeping snapshots costs nothing against your profile limit — restoring one creates a new profile…
Profile storage is full (storage-quota-exceeded) — The total size of all your live profiles has reached your plan's storage allowance, so launching a session that uses a profile is refused.
Saved task limit reached, or session already saved — A saved task is a copy of the steps a finished or running AI session took (not its transcript). Two rules stop a save: each plan keeps a fixed number of saved tasks, and a session is saved once.
'Reconnect to make changes': the app is offline and view only — Everything in the app lives on your account, so a change needs a connection to it.
A saved credential was not typed: 'this page is on … and it may only be typed on …' — Driftstack types a saved credential only on a secure page of a website it was saved for. Anywhere else the step is refused before anything is typed, and the task stops there.
Saved credentials: save a password for the AI agent, use it in a task, delete it — Save the value once on the dashboard, locked to the websites it is for, and write its handle in an agent task. The AI is given the handle, never the value.
Session was closed after inactivity — The session was ended because nothing happened in it for a while.
'The part of this session's connection that we run did not start / stopped' — A part of the session's network path that we operate failed — before the session ran, or while it was running.
'This session has ended and can no longer be used' (410) — The session you sent that action to is over — it was stopped, timed out, or ended on our side — and a session cannot be brought back.
'Session ended' overlay, 'Couldn't reach the live-stream server', Reconnect — "Session ended" means the browser behind this window really stopped — the overlay's recap line says why (inactivity, time limit, no Mac free, and so on).
'The session is still starting. Try again in a few seconds.' (409 session-not-ready) — A message reached a session whose browser had not finished starting, even after waiting for it. Nothing ran; send the same message again a few seconds later.
'Session time limit reached' (sessions have a time limit) — The session ran for as long as a single session may run, or the trial ran out of session time, and it was closed.
Session operation exceeded its timeout (504) — A tap or typing sent from code to a running session got no answer in time, so it is not known whether it was applied; the session itself is usually still running.
Session window is view only: keyboard and device input unavailable — You can see the session but cannot tap or type.
The session window could not open — The desktop app could not open the session window.
Stop a running session (what is lost) — Press Stop on the session's card (Sessions in the sidebar, or the profile's row).
'requires admin role on that team' when launching or stopping — In a team owner's workspace your role is member or admin: a member can look at the owner's saved things but cannot change them, so launching, creating and stopping sessions need…
Watch a session you started from code — A session your program started (POST /v1/agent-sessions) is listed under Sessions in the desktop app's sidebar as an "API session"; press Watch to open its live iPhone window.
'Starting the VPN tunnel… the address bar unlocks once the session is live' — The address bar stays locked until the session is live.