The Panelica mobile server management app lets you monitor and manage your server from your phone. Connect securely via QR code pairing — no passwords transmitted.
Step 1: Open the Pairing Screen
Two ways to start:
- Header QR Icon — Click the QR code icon in the top navigation bar (ROOT users only)
- Developer > API > Mobile App tab — Full management interface
Step 2: Generate QR Code
- Click "Generate Pairing Code"
- A QR code appears with a 120-second countdown timer
- The QR encodes a one-time pairing token (64-char random, nonce-protected)
Step 3: Scan with Mobile App
- Open the Panelica app on your phone
- Tap "Add Server" and scan the QR code
- Alternatively, copy the pairing link and open it in your mobile browser
Step 4: Receive Credentials
- Your device receives a unique API Key (mk_XXXX) and Secret
- These credentials are shown only once — the app stores them automatically
- The secret is encrypted with AES-256-GCM on the server
Server Monitoring:
- Real-time CPU, RAM, and disk usage
- Network traffic (RX/TX in Mbps)
- Load average (1m, 5m, 15m)
- System uptime
Domain Management:
- View all domains with status
- SSL certificate status and expiry dates
- PHP version per domain
Bandwidth:
- Current month usage (bytes/MB/GB)
- Plan limit and usage percentage
Backups:
- View recent backups (last 10)
- Trigger backup runs remotely
Services:
- Restart services from your phone
- Terminal access for ROOT users (via real-time)
From the Developer > API > Mobile App tab:
- View all paired devices with platform (iOS/Android), model, last used date
- See request count and last IP per device
- Edit per-device scopes (restrict what each device can access)
- Revoke a device (can be restored later)
- Permanently delete a device
Available scopes:
- domains:read — View domains
- server:read — Server metrics
- bandwidth:read — Bandwidth data
- backups:read — View backups
- backups:run — Trigger backups
- services:restart — Restart services
- terminal:access — Terminal (ROOT only)
- No passwords are transmitted — token-based pairing only
- All API calls signed with HMAC-SHA256
- Secrets encrypted at rest with AES-256-GCM
- Per-device granular permissions
- 5-minute timestamp tolerance prevents replay attacks
- Devices can be revoked instantly from the web panel
---
For issues with this feature, please report in the Bug Reports forum.
Last edited: