Quick Connect opens an SSH session from the browser to a host you type in, with credentials you supply on the spot. Nothing about the host has to exist in Shellius first.
Use it for the machine you will touch once — a freshly provisioned box before it is onboarded, a customer host during a call, a device you are evaluating. For anything you return to, save it as a server (or to My hosts) so it gets policies, approvals and an owner.
This is a browser route
The Shellius backend opens the SSH connection, not your machine. The host has to be reachable from the backend, and a private host works without a VPN when Shellius sits on that network. See Network reachability.
Required permissions
| Permission | Default roles | Allows |
|---|---|---|
quick_connect.use | Manager, Admin, Super admin | Open Quick Connect sessions with one-off credentials. |
quick_connect.use_stored_identity | Admin, Super admin | Use an organization Keystore identity in Quick Connect. |
quick_connect.save_server | Manager, Admin, Super admin | Turn a Quick Connect target into a saved server. |
quick_connect.settings | Admin, Super admin | Turn Quick Connect on or off for the organization. |
vault.use | Every built-in role | Use your own personal identities in Quick Connect. |
Turn it on or off
Quick Connect is on by default. Under Administration → Quick Connect, the Enable quick connect switch turns it off for the whole organization. While off, nobody can open a Quick Connect session, whatever their role.
Open a session
- Select Quick connect in the top bar, or press g then q.
- Enter the host (a hostname, IPv4 or IPv6 address) and port.
- Under Credentials, choose one:
- Password — a username and password.
- Private key — a username and a pasted key, with its passphrase if it has one. Add a password as well for hosts that require both.
- Saved identity — an identity from the Keystore or your personal vault. The username defaults to the identity's.
- Optionally paste an Expected host key fingerprint. If the host presents anything else, the connection is refused.
- Connect. The terminal opens and reports the host key it saw.
A pasted key can be in any format the Keystore imports — OpenSSH, PEM, PKCS#8 or PuTTY .ppk.
What happens to the credentials
One-off passwords and keys are never saved. Shellius places them in an encrypted, single-use ticket that expires after 60 seconds and is bound to your user. Opening the terminal consumes the ticket; it cannot be replayed.
The audit log records the host, port, username and authentication type — never the secret.
What it refuses
Quick Connect runs the same checks every time, including when you reconnect from history.
| Guard | Behaviour |
|---|---|
| Production hosts | A target that matches a saved prod server — by hostname, by IP address, or by resolving to the same address — is refused. Use the access request flow instead. |
| Deny policies | If the target matches a saved server and a deny policy bars you from it, Quick Connect is refused too. It is not a way around access policies. |
| Internal targets | Loopback, link-local (including cloud metadata addresses), unspecified and multicast addresses are refused. |
| DNS rebinding | The hostname is resolved once. The session connects to that resolved address, not to a fresh lookup. |
| Rate limit | 30 connection attempts per user per minute. |
Sessions are recorded like any other
A Quick Connect session is a normal session: it appears under Sessions with the authentication method shown as Quick Connect, and it follows the organization's recording rules. It simply has no saved server attached.
Recent connections
The Terminals page and the new-connection dialog list your Recent Quick Connects — host, port, username and whether the last attempt connected. It holds no secrets and entries are removed after 7 days. Only you can see your own history, and you can delete single entries or clear it.
Reconnecting in one step works only when the original session used a saved identity. For password or key sessions the dialog reopens pre-filled and asks for the secret again, because Shellius never kept it.
Keep the host
From a Quick Connect session you can keep the target in two ways.
Save as server makes it a shared server in the inventory. You choose a customer and an environment, and optionally how it authenticates:
| Choice | Needs |
|---|---|
| No identity — a certificate server, to be bootstrapped later | quick_connect.save_server |
| An existing Keystore identity | plus servers.manage_credentials |
| A new identity created from the credentials you just used | plus servers.manage_credentials and keystore.manage |
Save to My hosts keeps it in your private list instead. With Also save as a private identity the credentials become a personal identity that only you can use.