Manage hubs

A saved hub holds its relay address and certificate settings. Several sites can use it through their own connection routes. Adding a hub to Watchpost does not install a server or connect a site’s router. Start with Install a hub and Connect a site for those tasks.

Add or edit a hub

On Mac, choose Devices → Hubs… or use Connect a Hub… / New Hub… in the Devices sidebar. Select a saved hub to open its screen; its menu offers Edit Hub…. On iPhone and iPad, hubs appear in Devices; you can also add one from the Add menu. On Android, open Hubs from Devices, then connect a hub or open an existing entry. Editing requires unlocked storage.

Paste the hub code into Hub code, or fill in the fields:

Field	What to enter
Name	Optional label in your registry; otherwise the hub’s address identifies it
Address and Relay port	The relay host and port, normally 443
Certificate fingerprint	SHA-256 of the hub’s own certificate; leave empty for a certificate trusted by the system
Admin token	Optional credential for the hub’s management API

A fingerprint must contain 64 hexadecimal digits after normalization. Use the fingerprint provided by your hub administrator. The hub code fills the address, port and certificate settings; a code with an admin token also fills that secret field. The form clears a code containing the token from view.

Choose Save to keep the entry. This checks required fields, not whether the server answers or the token works. Adding the same relay again reuses the saved hub when host, port and certificate settings match.

In an edit form, leaving the admin token empty keeps the saved token. Remove the admin token deletes its local copy when you save. This does not revoke the token on the server. Changing the relay address or certificate affects every site’s routes through that hub and can restart their device connections. Closing the form without Save leaves its fields unchanged.

Read the hub screen

The Apple screen shows the address, certificate, management rights and response status. A key in the list means this installation has an admin token; it does not prove that the token is valid. Without one, the app cannot query the hub’s inventory and shows Not checked. Site access can still work with the separate route access tokens.

With a working admin token, Sites on the Hub lists server sites and networks, their association with your registry, and router tunnel status. Other Tunnels contains WireGuard peers added outside Watchpost. They may serve something else.

The router status comes from its latest WireGuard handshake. It does not prove that a camera is signed in or video is playing. On Apple platforms the screen refreshes while open, roughly every 30 seconds; Refresh asks again immediately. An error can leave older rows visible. Read the response error as well as the rows.

Used By lists local sites whose routes reference this hub. On Apple platforms, their menus can open Site Connection…, Router Setup… for routes you set up, or Remove Route. Add Site to the Hub… opens router setup for a local site not yet using this hub. A received route does not give you its router’s setup key.

Choose the correct removal

Action	Effect
Remove Route in a local site’s connection	Removes the local route and its local token/key after Save; the site stays on the hub
Remove Hub… from the saved list	Removes the hub entry and its local admin token; available only when no local site uses it
Remove beside a server site, then Remove from the Hub	Removes that site on the server, invalidates its access and closes its router tunnel; everyone relying on it loses that path
Remove an entry under Other Tunnels	Closes that server tunnel, including any use outside Watchpost

Review the confirmation before a server removal. Removing a site on the hub leaves its local route in Site Connection until you remove it there. It does not delete your local device entries. Removing a local site is another separate action.

People and mobile differences

On Mac, People and Invitations manage access given from this Mac: see People and invitations. The raw server site rows can also list people with individual relay tokens and offer Cut Off. Cutting one of those tokens affects that person’s access to that server site.

iPhone and iPad have the hub inventory and local site controls, but do not include the Mac People/Invitations workflow. Android offers the hub form, server sites and other tunnels, Refresh and removal. It has no equivalent router setup wizard or Mac People controls; use Site Connection to edit local routes.