# Dashboards & browser

> Multiple dashboards, rotation and planner, allowed hosts, zoom, reload, Home Assistant sign-in and theme, hiding the HA header, and the JavaScript bridge.

Everything on this page lives under **Settings, Dashboard**. It applies when **Kiosk mode, Show** is set to **Browser** (the default). For single-app mode see [Choosing a mode](modes.md#single-app-mode).

## The start URL

The **Dashboard** card holds the first dashboard, which is named **Home**:

| Field | Meaning |
|---|---|
| Start URL | The page the tablet opens on start. Must be `http://` or `https://`. |
| Extra allowed hosts | Comma-separated hosts, besides your dashboards, that pages may navigate to. |
| Reload every N minutes | Automatic reload. `0` turns it off. The maximum is 1440 (one day). |

Tap **Save dashboard** to apply. The **Reload** command and the Home Assistant **Reload** button do the same on demand.

## Allowed hosts

Kiosky only navigates to hosts it trusts: the host of each dashboard URL (any port) plus your extra allowed hosts. Everything else, other schemes included, is blocked. The same list gates the `load_url` and `popup` commands and sound URLs for `play`.

An allowed-host entry is one of:

| Entry | Matches |
|---|---|
| `example.com` | exactly that host, any port |
| `*.example.com` | any subdomain, but not `example.com` itself (list both if you want both) |
| `example.com:8123` | that host on that port only |
| `*.example.com:8123` | any subdomain on that port only |

If a dashboard redirects through another host (a login page, a CDN), add that host here. The setup wizard adds a redirect target for you when it sees one.

## Multiple dashboards

**More dashboards** adds extra named dashboards beside Home. Enter a **Name** (up to 64 characters, unique ignoring case) and a **URL**, then **Add dashboard**. **Remove** deletes one.

With two or more dashboards you can:

- **Swipe between dashboards**: switch on under **Navigation** and swipe in from the left or right screen edge.
- **Show a home button**: a floating button that returns to the first dashboard.
- **Switch by command**: the `dashboard` command, or the Dashboard select entity in Home Assistant. See [Home Assistant integration](home-assistant.md).
- **Rotate or schedule** them, below.

> **Note.** Dashboard rotation and the planner are listed among the candidate Pro features in the app. While Kiosky Pro is in development every feature is unlocked. See [Kiosky Pro](pro.md).

### Rotation

**Dashboard rotation** cycles dashboards while the screen is on and untouched. Turn on **Rotate dashboards**, then set:

| Setting | Default | Range |
|---|---|---|
| Switch every | 60 s | 5 to 600 s in the app (the config accepts up to 3600) |
| Pause after a touch | 60 s | 0 to 600 s |
| Dashboards in the rotation | all | at least two |

### Planner

The **Dashboard planner** shows a dashboard during a daily window. Add up to 24 rules, each with a dashboard, **From** and **To** times (`HH:mm`, the window may cross midnight) and the weekdays on which the window starts. The first matching rule wins.

Priority, from highest: the night page (see [Screen, power & screensaver](screen-power.md#night-mode)), then planner rules, then rotation. A manual switch (a swipe or a command) holds until the next rule starts or ends.

## Page display and navigation

| Setting | Default | Notes |
|---|---|---|
| Text zoom | 100% | The slider runs 50 to 300%. |
| Desktop mode | Off | Asks sites for their desktop layout. |
| User-agent override | blank | Blank uses the default. Up to 300 characters. An explicit value wins over Desktop mode. |
| Swipe between dashboards | Off | Swipe in from the left or right edge. |
| Pull to refresh | Off | Pull down from the top edge to reload. |
| Home button | Off | Floating button back to the first dashboard. |

## Home Assistant

Under **Home Assistant sign-in**, enter your **Home Assistant address** (for example `http://homeassistant.local:8123`) and a **Long-lived access token**, then **Save sign-in**. Create the token in Home Assistant under your profile, Security, Long-lived access tokens.

- The dashboard logs in without the login screen. The token is stored encrypted and is only given to the address you entered.
- A saved token shows "A token is saved. Leave blank to keep it." **Remove token** deletes it.
- Changing the address to a different origin removes the stored token, so a token can never be sent to a new server by accident.
- A token is not sent to a plain `http://` address that is not on your local network. Use `https://` for public addresses.
- The same token powers camera popups and voice. See [Camera & sensors](camera-sensors.md) and [Home Assistant integration](home-assistant.md#voice-and-assist).

### Home Assistant theme

**Home Assistant theme on this tablet** sets an HA theme for this tablet only. Enter a theme name such as `Graphite` (blank keeps HA's default), choose **Light or dark** (Auto follows the tablet's setting), and tap **Save theme**.

### Hiding the Home Assistant header and sidebar

Under **Custom CSS and JavaScript**, **Hide Home Assistant chrome** is built in and needs no HACS card. Choose:

- **Show**: nothing is hidden.
- **Hide header**: hides HA's top bar and keeps the sidebar for navigation.
- **Hide both**: hides the header and the sidebar.

To bring the hidden parts back, **double-tap within the top 48 pixels of the screen**. They reappear for 15 seconds and then hide again. The revealing tap is swallowed so it cannot press whatever appears underneath.

The preset applies to your Home Assistant address. It works by editing HA's page styles, so a major change to the HA frontend can break it. If that happens, switch to **Show**.

## Custom CSS and JavaScript

Add your own rules under **Custom CSS and JavaScript**: a **URL pattern** (for example `ha.local:8123/*`, where `*` matches any run of characters), **CSS** and **JavaScript**, then **Add rule**. You can have up to 20 rules, each part up to 20,000 characters. Rules run on matching pages only.

> **Warning.** Injected scripts run inside your pages with full access to them. Only add code you trust. Over the network, changing injection rules is a protected change, see [Security](security.md#protected-settings).

## Web access: the JavaScript bridge, microphone and camera

Under **Web access** you list origins (scheme, host and port, such as `http://ha.local:8123`), comma separated:

- **JS bridge origins**: pages from these origins get a `window.kiosk` object. Leave empty to turn the bridge off.
- **Microphone / camera origins**: pages from these origins may use the microphone or camera. They also need `https`. Leave empty to deny.

The bridge returns promises:

```js
// Read a limited device state: screen, screen_stage, brightness, battery,
// charging, light_lux, dashboard, volume, app_version (no IP, SSID or URLs)
const state = await window.kiosk.getState();

// Run a command a page is allowed to run
await window.kiosk.command("toast", { text: "Hello from the page", duration: 5 });

// Listen for events such as popup_shown
window.kiosk.onEvent((event) => console.log(event));
```

A page can only run `reload`, `load_url`, `dashboard`, `screen`, `brightness`, `screensaver`, `tts`, `play`, `stop_audio`, `volume`, `toast`, `popup` and `dismiss_popup`. Reboot, restart, cache clearing and snapshots are never available to pages, whatever your remote-control settings say.