> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/connect-to-servers/launch-tempest-from-url.md).

# Launch Tempest from URLs and External Tools

Launch Tempest from external tools, browsers, scripts, and bastion clients using Tempest deep links or SSH URLs on macOS, Windows, and Linux.

Tempest can be opened by other applications through OS-level links and command-line URLs. This is useful for internal portals, bastion clients, password managers, scripts, and compatibility shims that want to open a new SSH tab in Tempest.

## Registered Tempest URL scheme

Tempest registers the `tempest://` URL scheme with the operating system.

Today, the stable public `tempest://` route is used for collaboration links:

```
tempest://collaborate/<room-id>#<link-fragment>
```

Opening that URL brings Tempest to the foreground and joins the collaboration room.

## Launch an SSH tab

Desktop builds also support launching an ephemeral SSH connection by passing an SSH URL to Tempest:

```
ssh://user:password@host:22
```

Examples:

```bash
Tempest.exe --url ssh://alice:secret@127.0.0.1:2222
open -a Tempest --args --url 'ssh://alice:secret@127.0.0.1:2222'
tempest-desktop --url 'ssh://alice:secret@127.0.0.1:2222'
```

Tempest parses:

| Field    | Source                 |
| -------- | ---------------------- |
| Host     | URL hostname           |
| Port     | URL port, default `22` |
| Username | URL username           |
| Password | URL password           |

The connection is created as an ephemeral SSH tab. It is not saved to your encrypted vault unless you explicitly save it later.

## Compatibility with bastion clients

Some bastion systems launch a known SSH client such as Xshell, PuTTY, SecureCRT, or MobaXterm instead of a generic URL handler. In that case, use a small compatibility shim that accepts the third-party client's command-line format and forwards a normalized SSH URL to Tempest.

For example, an Xshell-style launch:

```
Xshell.exe -url ssh://user:password@127.0.0.1:2222 -newtab server-name
```

Can be converted by the shim into:

```
Tempest.exe --url ssh://user:password@127.0.0.1:2222
```

Common formats to normalize:

| Client    | Typical SSH launch format                                      |
| --------- | -------------------------------------------------------------- |
| Xshell    | `-url ssh://user:password@host:port -newtab title`             |
| PuTTY     | `-ssh -l user -pw password -P port host`                       |
| SecureCRT | `/SSH2 /AUTH password /L user /PASSWORD password /P port host` |

Tempest itself should receive the normalized SSH URL through `--url`.

## Security notes

Putting passwords in URLs or command-line arguments can expose them to shell history, process listings, crash logs, and other local tooling. Prefer short-lived bastion credentials or one-time passwords when integrating through URLs.

For long-lived credentials, save the host in Tempest and store secrets in the encrypted vault or operating-system credential store instead.

## See also

* [Where Tempest Stores Your Credentials](/account-and-privacy/where-tempest-stores-credentials.md)
* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption.md)
* [SSH Jump Host & Bastion Chaining](/connect-to-servers/ssh-jump-host-bastion-chaining.md)