Access to a Yuri host can lead to file and tool operations on that computer. Choose the connection scope and credentials for the people and devices that should have that access.
Browser login and paired clients are different
A terminal-hosted web UI can use --ui-password or YURI_UI_PASSWORD. Set your own password before making that UI reachable by other machines.
A paired app uses its issued client credential. Manage and revoke those clients on the host through Remote Instances. A single-use pairing link authorizes enrollment; keep an unused one private until the intended device redeems it.
Add a convenient sign-in method
Passkey controls are under Settings → Sessions, in the Passkeys group. Registration depends on browser/runtime support and host authentication configuration. Follow the status shown there rather than assuming a biometric device alone is enough.
Use the listed passkeys and sign-out controls to review access. If registration or global sign-out is unavailable, read its reported reason; resetting unrelated project files will not resolve an authentication policy.
Keep exposure intentional
LAN binding, Relay and an HTTPS reverse proxy solve different connectivity problems. None replaces host authentication. Start with the narrowest route that serves the devices you intend to use.