Chrome 142+: enter a full http:// LAN URL, approve Local Network Access, and add this page's exact origin to Moonraker cors_domains (hosted app: https://orcaxr.martinez.fyi). CORS is also required for cross-origin HTTPS. HTTP is unencrypted; use it only on a trusted LAN. Otherwise use HTTPS or Tailscale Serve.

Kept in this browser's storage so they survive a reload. Turn this off on a shared machine — it also erases what is already saved. Anything that can run script on this origin can read them; the app's CSP is what keeps that to code it ships itself.

Off follows your system's reduced-motion setting, which this app already honours. On suppresses animation here regardless of it.

An export carries this device's setup but never a token, so it is safe to share or attach to a bug report. Reset clears the setup only — projects and presets stay.

A local http:// server works on Chrome 142+ after Local Network Access permission. The Docker server already enables CORS; use HTTPS for untrusted or remote networks. A server published beyond loopback requires ORCAXR_SERVER_TOKEN — paste it above. The token is kept for this tab only and is never saved to disk, so re-enter it after a reload.

Off — slicing locally in‑browser.

Plain-HTTP LAN access is not a secure context: WebXR, in-browser WASM slicing (SharedArrayBuffer), and service workers are unavailable. Use http://localhost:3000 or Tailscale Serve (HTTPS) for full capability.

Configure a session-only key with the header gear, then use Smart Paint from the shared Tools menu.