Guide · updated November 5, 2026
How to approve Claude Code decisions from your phone
Either use Anthropic's Remote Control to continue a session from your phone, or have your agents post their questions to a small inbox page and reach that page through a tunnel that only you can sign in to. Never open the port to the internet without authentication.
Option 1: Anthropic's Remote Control
Anthropic documents a Remote Control feature for continuing a Claude Code session from another device, included with its paid plans (Claude Code docs). It's the simplest choice when you're working with one session and want to keep chatting with it from your phone. Follow Anthropic's documentation for setup; we haven't covered it here.
Option 2: A decision inbox behind an authenticated tunnel
When several agents run unattended, you don't want to open each session to answer one question. Instead:
- Agents post their questions in a fixed shape, one per message, for example
needs Sam: Merge PR #42 today? — tests green [Options: Merge now | Wait]. - A small local web page lists them with a button per option and sends your answer back to the agent that asked.
- The page listens only on 127.0.0.1, and you reach it from your phone through a tunnel with sign-in.
Putting it behind a tunnel safely
- ngrok with OAuth (what we use): start the tunnel with Google sign-in restricted to your own address, for example
ngrok http 4610 --oauth=google --oauth-allow-email=you@example.com. Anyone else who finds the URL gets a sign-in page they can't pass. - Tailscale:
tailscale servemakes a local port reachable only from devices on your tailnet. It should work the same way; we haven't tested it with our setup.
Two more protections worth having: let the page answer only requests for the tunnel's exact hostname (reject unknown Host headers), and require a token for anything that changes state.
Where Elco Console fits
Elco Console has this inbox built in ("Waiting on you", grouped into Fix, Decide and Drafts, with Yes/No or option buttons). It listens on 127.0.0.1, requires a token for every change, and accepts only hostnames you list in publicHosts. Phone access is the tunnel recipe above, set up by you. There's no Elco Dev server in between.