# Add another Mac

> Add a second Mac to your Personal Cloud account by signing in on it, then comparing a 6-digit code on both Macs with Compare Codes and Codes Match.

Source: https://docs.subcloak.com/cloak-proxy/cloud/add-a-mac/

Added in Cloak Proxy 0.6.0.

Each Mac on your account holds the key to your synced data, so a new Mac can't get it just by signing in. A Mac you already use approves it, after you've checked that both Macs show the same 6-digit code. The code is how you know the request really came from the Mac in front of you and not from someone else.

You need the new Mac and a Mac that's already set up, both with Cloak Proxy open. If you don't have another Mac to hand, use your [Recovery Kit](https://docs.subcloak.com/cloak-proxy/cloud/recovery-kit/#get-back-in-with-the-kit) instead.

## Approve a new Mac

1. **On the new Mac**, open **Settings › Cloud**, click **Get Personal Cloud…** and sign in with the same email, as in [Get started](https://docs.subcloak.com/cloak-proxy/cloud/get-started/#set-up-your-first-mac). Give it a name you'll recognize in **This computer**.

   Because your account already has computers, the sheet changes to **Approve this Mac** and waits: "Waiting for your other computer…".

   {/* TODO(screenshot): cloud-sheet-approve-this-mac-waiting-light */}

2. **On a Mac you already use**, open **Cloak Proxy › Settings… › Cloud**. A sheet says **"MacBook Air" wants to join your Personal Cloud account**, with the time of the request and its approximate country.

   If you aren't signing in on that computer right now, click **Deny**.

3. Click **Compare Codes**. A code appears under **Does "MacBook Air" show this code?**

   {/* TODO(screenshot): cloud-sheet-approve-other-light (code 417 902). Pair it with cloud-sheet-approve-this-mac-light below, side by side if the layout allows. */}

4. **On the new Mac**, the same 6 digits appear. Compare them with the other Mac's, digit by digit. If they match, click **Codes Match**. The new Mac then says "Approve on your other computer to finish."

   {/* TODO(screenshot): cloud-sheet-approve-this-mac-light (code 417 902, Codes Match button) */}

5. **On the Mac you already use**, click **Codes Match: Approve**.

6. **On the new Mac**, the sheet moves on to **Restore this Mac**: choose what comes onto it and click **Restore**. See [Restore this Mac](#restore-this-mac) below.

The new Mac now appears under **Settings › Cloud › Devices** on every computer on your account. It doesn't need a Recovery Kit of its own: the kit you saved on your first Mac works for the whole account.

> **Only approve when the codes match:**
> Approve a request only if you started it yourself, on a computer you're sitting at, and the two codes are the same. An approved computer can read all your synced data. If the codes differ, click **Deny** on the Mac you already use, and **Cancel** on the new one.

## Why the code matters

Each code is worked out from both Macs' keys and a random number from each Mac, and each Mac commits to its number before it sees the other's. If anything between the two Macs swapped in a different computer, the codes on the two screens would be different. Neither Mac uses the approval until you've confirmed the match on it.

The Mac you already use only answers a request when you click **Compare Codes**, and only a few in a short time, so nobody can keep asking until a code happens to match. See [Security and privacy](https://docs.subcloak.com/cloak-proxy/cloud/security/#adding-a-computer).

## Restore this Mac

A Mac that joins an account that already has data, whether you approved it from another Mac or used your Recovery Kit, gets **Restore this Mac** instead of **Choose what syncs**. It brings back everything you sync in one step.

{/* TODO(screenshot): cloud-restore-light */}

- **A list of what's in your account**, one row per type with a switch and its size, for example "142 rules in 9 folders", your mock sets, scopes, saved queries, highlight rules and filters, and each API workspace with the folder it will go in (**Change…** picks another empty or new folder). Settings is a row too, off by default.
- **As of**: when the newest change was made, and on which Mac.
- **If this Mac already has its own rules and mock sets**, choose **Merge with This Mac's** (both sets are kept and sync to your other Macs) or **Replace This Mac's** (this Mac's go to **Removed by Sync**, where you can put them back for 30 days).
- Rules and mock sets that run scripts, serve local files or redirect traffic arrive switched off until you review them. The root certificate, passwords and secret values never sync.

Click **Restore**, or **Not Now** to do it later: Settings › Cloud then shows **Finish setting up Personal Cloud**, and **Continue…** offers the restore again.

### Finish setting up this Mac

After the restore, **Finish setting up this Mac** lists what came back (with **Open in API Client** for workspaces) and the few things that never sync:

| Row | What to do |
|---|---|
| **Trust this Mac's certificate** | Each Mac makes its own root certificate; it's never restored. Click **Install & Trust…** to see HTTPS traffic. |
| **Route traffic through Cloak Proxy** | Click **Turn On** to turn on the macOS proxy for this Mac, as on your other one. |
| **N items arrived switched off** | They run scripts, serve local files, redirect traffic or answer requests. **Review…** opens them. See [Review changes from another Mac](https://docs.subcloak.com/cloak-proxy/cloud/review-changes/). |
| **Map Local rules point to files that aren't on this Mac** | **Show** lists them. Copy the files over, or edit the rules in Debugging Tools › Map Local. |
| **Never synced: secret values and passwords** | Environment secrets, Vault values, and proxy and client-certificate passwords stay on each Mac. **Show Where** lists the secret variables that came back empty. |

Click **Done** when you're finished. **Help › Moving to a New Mac…** describes the same steps.

## When the new Mac arrives

- **Rules and mock sets already on the new Mac stay.** Synced ones are added next to them, and from then on both Macs share one set.
- **Rules that can act on the Mac arrive switched off.** Scripts, Map Local, Map Remote, DNS Spoofing, Rewrite rules, mock sets and failure scenarios that come from another Mac wait for you under **Sync issues**. Switch on the ones you want. See [Review changes from another Mac](https://docs.subcloak.com/cloak-proxy/cloud/review-changes/).
- **Debugging tools keep this Mac's on/off switches.** Turning on Map Local on one Mac doesn't turn it on everywhere.
- **Passwords and secret values stay behind** unless you chose to sync them. See [What syncs](https://docs.subcloak.com/cloak-proxy/cloud/what-syncs/#secret-values).

## If it doesn't work

| Message | What happened | What to do |
|---|---|---|
| **The request was denied on your other computer. If that wasn't you, nothing was shared.** | Someone clicked **Deny** on your other Mac. | Click **Ask Again** on the new Mac. |
| **The request expired after 10 minutes. Ask again.** | Nobody answered in time. | Open Settings › Cloud on your other Mac first, then click **Ask Again**. |
| **The computer answering isn't one of your signed-in computers. Nothing was shared.** | The answer didn't come from a computer on your account. | Click **Ask Again**. If it happens again, don't approve anything and contact support. |
| **The answering computer changed during the request, so it was stopped. Ask again.** (or another "…so it was stopped" message) | The request changed after a Mac answered it. Nothing was shared. | Click **Ask Again**. |
| **The request changed after this Mac answered it, so it was denied. Nothing was shared.** | Shown on the Mac you already use. | Start again from the new Mac. |
| **This Mac has answered 3 requests to join in the last 10 minutes…** | Your Mac answers only a few requests at a time. | Wait a few minutes. If you didn't ask to sign in that often, deny the request. |
| **A request to join from "…" that this Mac answered disappeared before it was approved…** | A request you answered vanished without being approved or denied. | If you didn't cancel it, someone may be trying to join your account. Don't approve requests you didn't make. |
| **Your plan allows 5 computers. Remove one in Settings › Cloud before approving another.** | The account already has 5 computers. | [Remove a computer](https://docs.subcloak.com/cloak-proxy/cloud/remove-a-mac/) you no longer use, then try again. |

Nothing appears on your other Mac? Make sure it's signed in, set up and showing **Settings › Cloud**. The request appears there, not in a notification.

## Related

  - [Review changes from another Mac](https://docs.subcloak.com/cloak-proxy/cloud/review-changes/): Switch on synced rules that act on this Mac.
  - [Remove a lost or stolen Mac](https://docs.subcloak.com/cloak-proxy/cloud/remove-a-mac/): Take a computer off your account and change the key.
  - [Recovery Kit](https://docs.subcloak.com/cloak-proxy/cloud/recovery-kit/): Add a Mac when no other computer is around.
  - [Security and privacy](https://docs.subcloak.com/cloak-proxy/cloud/security/): How approval protects your account.