Devices

A device does not need an agent, a tunnel or software from Whisper to sit behind your resolver. It needs one resolve-only credential, which answers its name lookups under your account's policy and can do nothing else to the account.

whisper device add --label "work-laptop"

That one call mints the credential and prints everything the machine needs: the encrypted DNS URL, a one-tap profile link for Apple platforms, the Private DNS host for Android, and the device's own routable address. The token is shown once.

The steps differ between platforms, so they have a page of their own: Set Up a Device covers Apple, Android, Windows and Linux, along with the lookup history page and how to take a device back off.

Two things are worth knowing before you start. The credential is resolve-only by construction, so it can never register, read or change anything on your account, which is what makes it safe to install on a family member's phone. And the device still gets a routable identity with a reverse record and a registry entry, so it is checkable by anyone in the same way an agent is; that identity is described in Device Identities.

Policy is set for the account, not per device, so what a device may resolve is whatever Resolver Policy says.