The web server only works while Rikka is running on your Android device. Closing or force-stopping the app shuts the server down. A persistent foreground notification keeps the server alive when the app is in the background.
Starting the Server
Configure the port
Enter a port number in the Port field. The default is 8080. Use any value between 1024 and 65535. You cannot change the port while the server is already running.
Choose network visibility
Toggle Localhost Only if you want the server accessible only from the device itself (useful for ADB port forwarding). Leave it off to allow access from other devices on your Wi-Fi network.
Set an access password (recommended)
Enter a password in the Access Password field. See Securing the server below.
Finding the Server URL
Once the server is running, the Web Access page shows the available addresses:| Address type | When shown | Example |
|---|---|---|
| LAN Address | Localhost Only is off | http://192.168.1.42:8080 |
| mDNS Address | Localhost Only is off, mDNS available | http://android-device.local:8080 |
| Local Address | Always | http://localhost:8080 |
Securing the Server
Rikka uses JWT-based authentication to protect the server:Enter an access password
Type a password in the Access Password field on the Web Access settings page.
Enable JWT authentication
Toggle on Enable JWT Auth. This toggle becomes available once you have entered a non-empty password. Clearing the password automatically disables JWT auth.
Configuration Reference
The TCP port the HTTP server listens on. Must be between 1024 and 65535. Shown as an error state if the value is out of range. Cannot be changed while the server is running.
When enabled, the server binds to
127.0.0.1 and is only reachable from the device itself. When disabled, the server binds to all network interfaces and is reachable from other devices on the same network. Cannot be changed while the server is running.Require a signed JWT token for every request. Tokens are issued at login using the Access Password. Only available when the access password field is non-empty.
The password users must enter in the browser to obtain a JWT token. Clearing this field automatically disables JWT auth. Treat this like any other sensitive credential.