How Facenox Pairs Computers and Syncs Attendance Records

Facenox Desktop records attendance locally. Connecting it to Facenox Cloud lets administrators review synced records and reports from a browser, without giving the desktop direct access to the Cloud database.

Correction, October 23, 2026: An earlier version described Ed25519 provisioning, device JWTs, HMAC-signed batches, and a nonce-based replay policy. Those descriptions did not match the inspected device authentication path. The explanation below replaces them.

1. Pairing a Computer

An administrator can generate a single-use pairing code for a location and enter it in Desktop settings. A device-initiated approval flow is also supported.

Cloud validates the pairing request and returns an opaque device token and a location encryption key. The pairing code is the setup credential the user enters; the device token is the credential used for subsequent requests.

2. Authenticating Sync Requests

The desktop sends its device token in the HTTP Authorization header as a Bearer credential. Cloud hashes the supplied token and looks up an active token record associated with a paired device and an available location.

The push endpoint checks that the payload's device and location identifiers match the authenticated device. The pull endpoint obtains the organization and location from that authenticated context.

Account sign-in and device sync use separate authentication flows. A paired computer uses its device token, rather than the administrator's account passkey, to authenticate sync requests.

3. What Sync Transfers

Directory details, attendance records, and sync activity support reporting and administration. On eligible paid plans, encrypted face templates also sync between paired computers at a location. Raw camera frames are not uploaded for face recognition.

The sync endpoints validate versioned payloads. Directory reconciliation uses revisions and records removals as well as additions and updates.

4. Template Encryption and Server Access

Desktop encrypts face templates with a location key before uploading them. Cloud stores the encrypted templates and manages recoverable location keys.

When a member transfers between locations, the server decrypts the template in memory and re-encrypts it with the destination key. The transfer helper clears its plaintext buffer afterward. Face recognition itself remains on the desktop.

This is not a zero-knowledge design: encrypted storage does not make Cloud technically unable to decrypt templates.

5. Connectivity and Recovery

Connected computers can receive notifications that prompt them to request updates. Delivery and timing depend on connectivity and service availability. During an internet outage, Desktop can continue recording locally; Cloud shows the records it has received so far.

Synchronization also propagates changes and removals. It is not an independent recovery backup. Keep separate password-protected desktop backup archives when you need a recoverable copy.

Implementation References

The corresponding Cloud source paths are apps/web/lib/pair-device.ts, apps/web/lib/devices.ts, apps/web/lib/encryption.ts, apps/web/lib/directory-transfer.ts, and the apps/web/app/api/sync/ routes.

For the public desktop implementation and data-handling notes, see the Facenox repository and privacy documentation.