# Choosing a mode

> Normal app, soft lock or full lock (Device Owner), single-app mode, pausing the lock and leaving the kiosk.

Kiosky can run in three ways. You choose at setup and can change it any time under **Settings, Lock & security, Kiosk lock, Mode** (the choices are **Normal app** and **Locked**).

| | Normal app | Soft lock | Full lock (Device Owner) |
|---|---|---|---|
| Computer needed | No | No | Yes, one `adb` command |
| Home and Back buttons | Work normally | Home returns to Kiosky | Blocked by default |
| Status bar and notifications | Normal | Normal | Blocked by default |
| Other apps | Usable | Reachable through Home or Recents | Only apps you allow |
| Easy to escape | Yes, by design | Fairly | No |
| Remote screen off in single-app mode | No | No | Yes |

Pick **normal app** for a tablet you also use yourself. Pick **soft lock** for a quick, computer-free lock that is fine at home. Pick **full lock** for a tablet that must stay on the dashboard, such as a hallway panel or a public display.

## Normal app

Kiosky runs like any other app, but keeps its background services (Home Assistant, MQTT, the REST API, voice and sensors) running while you use other apps. Under **Lock & security** the **Normal app** card has these options:

| Setting | Default | What it does |
|---|---|---|
| Start on boot | On | Opens Kiosky when the tablet turns on. |
| Show on remote command | On | Brings Kiosky to the front when something remote shows content: loading a URL, switching dashboard, a popup, a camera popup, or turning the screen on. |
| Return when screen turns off | Off | Brings Kiosky back to the front when the screen turns off, so the next wake shows the dashboard. |

It also has two buttons for things Android needs you to allow:

- **Allow auto-start** opens your manufacturer's auto-start screen (see [Troubleshooting](troubleshooting.md#start-on-boot-and-vendor-auto-start-screens)). The hint names your brand, for example HONOR.
- **Allow "Display over other apps"** is needed so Kiosky can come to the front from the background.

If Kiosky is still your home app from an earlier lock, a **Choose home app** button lets you pick your usual launcher again.

## Soft lock

Soft lock makes Kiosky the default home app. Press Home and you land back in Kiosky. It needs no computer, but a determined user can still reach other apps through Recents.

1. Under **Lock & security, Kiosk lock**, set **Mode** to **Locked**.
2. Tap **Set home app** and choose Kiosky in the Android dialog.

In the setup wizard this is the **Use soft lock** button on the Kiosk lock step.

## Full lock (Device Owner)

Full lock uses Android's Device Owner mode. It blocks the status bar, the lock screen, the Home and Overview buttons and the power menu, and only lets the allowed apps run. It is the strongest lock Android offers to a normal app.

> **Warning.** Android only lets an app become Device Owner on a device that has no accounts. **Remove all accounts first** (Settings, Accounts), including the Google account, or the command fails.

1. On the tablet, remove all accounts under **Settings, Accounts**.
2. Turn on **USB debugging** (Settings, Developer options). See [Troubleshooting](troubleshooting.md#usb-debugging-and-file-transfer) if the option is missing.
3. Connect the tablet to a computer and run:

```bash
adb shell dpm set-device-owner com.enraio.kiosky/com.enraio.kiosky.feature.kiosk.KioskAdminReceiver
```

The tablet shows **Full lock active (Device Owner)** in the wizard, and a **Device Owner** chip in Settings. Kiosky shows the exact command for your build in Settings, Lock & security, Kiosk lock, with a **Copy command** button in the wizard. Debug builds use the application id `com.enraio.kiosky.debug`, so copy the command from the app rather than typing it if you run one.

To remove Device Owner later, use **Remove Device Owner** in the same place. That turns the lock off, and locking again needs the `adb` command again.

### Lock options

With Device Owner active, **Settings, Lock & security, Lock options (Device Owner)** controls what stays available while the tablet is locked. Changes apply the next time the kiosk locks (reopen the app). The options are saved even before Device Owner is active.

| Option | Default |
|---|---|
| Block the status bar | On |
| Hide the lock screen | On |
| Allow the home button | Off |
| Allow the overview (recents) button | Off |
| Allow the power menu | Off |
| Allow notifications | Off |
| Grant microphone, camera and notification permissions automatically | On |

**Settings, Lock & security, Other apps** lists apps that can be opened from the kiosk, for example a music or camera app. Tap **Edit allowed apps** to choose them. Full lock also lets Kiosky turn the screen off from a schedule or command and reboot the device.

## Single-app mode

Instead of a dashboard, Kiosky can keep one installed app on screen. Choose **A single app** in the wizard, or go to **Settings, Dashboard, Kiosk mode** and set **Show** to **Single app**.

- Kiosky stays the home app and reopens the app when it closes or crashes, waiting longer if it keeps crashing. **Reopen delay** is 1 to 30 seconds (default 2).
- **Open app now** starts the app straight away.
- Dimming and the screensaver are off, because Kiosky cannot see touches inside another app.
- With soft lock, Home or Recents can leave the app. Screen off from a schedule or command needs full lock.
- The exit corner and reopening after a kill need **Display over other apps**. The settings row shows **Done** or an **Allow** button. The exit corner is a 48 dp area at the top left.

## Leaving the kiosk

**Open Settings.** Tap the top-left corner of the screen 5 times quickly. If you set an admin PIN, enter it. In single-app mode the same five taps work on the corner overlay.

Wrong PINs are throttled: after 5 wrong attempts Kiosky locks PIN entry for 30 seconds, doubling with each further failure up to 15 minutes. The lockout survives a reboot. Every wrong attempt and every exit gesture is also published as an event for Home Assistant (`wrong_pin`, `exit_gesture`).

### Use the tablet normally for a while

**Settings, Lock & security, Use tablet normally** unlocks the tablet temporarily and locks it again by itself. Choose **15 min**, **1 h**, **4 h** or **Until I resume**. While paused you see when the lock returns, and can tap **Resume now** or **+15 min**. No pause, with all extensions, lasts longer than 24 hours.

**Lock again when idle** (on by default) resumes the lock after the screen has been off for 2 minutes.

You can also pause from Home Assistant or the REST API, which needs [remote unlock](security.md#remote-control-policy) to be enabled:

```bash
curl -X POST http://TABLET_IP:2323/api/command \
  -H "Authorization: Bearer $KIOSKY_TOKEN" -H "Content-Type: application/json" \
  -d '{"command":"kiosk_pause","args":{"minutes":30}}'
```

`kiosk_resume` ends the pause. See [REST API](rest-api.md#commands) for every command.

### Exit permanently

**Settings, Lock & security, Exit kiosk permanently** turns the lock off for good and opens Android Settings. The lock does not come back by itself. To lock again, switch **Mode** back to **Locked**.