Sign in to Emby on your TV without typing a password: QR code and phone approval

Typing a password with a TV remote is the most annoying part of running Emby for a household. It is slow, error-prone, and it usually ends with someone sharing an account password over chat, which you then have to rotate. Quick Connect removes that step: the screen shows a 6-digit code and a QR code, the user approves from their phone, and the screen signs in by itself. For the official Emby apps, where no screen page exists, each user can opt in to a one-time login code typed in the password field.

This tutorial walks through installation, configuration and daily use. It is written for people who already run Emby on their own server, on Linux, Windows or in Docker.

Prerequisites

• Emby Server 4.10.1 or newer. Older versions are not supported.
• A MediaLab Works account with an active license, a lifetime license inside its update window, or the free 30-day trial, so you can download the plugin DLL.
• For the button on the Emby Web sign-in screen: write access to Emby's dashboard-ui/index.html. If Emby cannot write that file, the panel shows the exact command to run on the server. The phone and screen pages work without the button.

Step 1: Install the plugin

1. Sign in to your MediaLab Works account, open Licenses and download the plugin DLL.
2. Copy the DLL into the Emby plugins folder and restart Emby Server:
   • Linux (package): /var/lib/emby/plugins/
   • Docker: the plugins folder inside your Emby config volume
   • Windows: %AppData%\Emby-Server\programdata\plugins\
3. Open Quick Connect in the Emby dashboard menu, click License, and paste your license key to activate it, or enter your e-mail to start the trial. The page shows the license as Active once the key is bound to this server.

The license is checked once a day and at every Emby start. Without internet the plugin keeps working for 7 days after the last successful check; after that it stops until it can check again. If the license is not valid, the phone and screen pages are unavailable and app codes are not accepted, but everyone can still sign in with their normal password.

Step 2: Configure the settings

Open Quick Connect in the Emby dashboard and go through the Settings tab:

• Phone sign-in is active: enables the phone and screen pages.
• Approval from the phone with username + password too: keep it on for phones where Emby is not signed in, or turn it off to allow only approvals from a phone that already has an Emby session.
• One-time codes for Emby apps: lets each user turn on app codes from the phone page.
• Administrator accounts cannot sign in with a code: off by default; consider turning it on.
• Screen code validity: 5 minutes by default, adjustable from 1 to 15.
• New account created from the phone: off by default. It needs Registration 1.10.5 or newer, and with an older Registration it has no effect.

Step 3: Add the button to the sign-in screen

On the Button on the sign-in screen tab, click Apply. The plugin writes one line into Emby's dashboard-ui/index.html, keeps a copy as index.html.before-quickconnect, and adds the button again after Emby updates. If the file belongs to root and Emby cannot write it, the page shows the exact command to run; Remove takes the button out again.

Step 4: Note the two addresses

The How to use tab shows the addresses on your server:

• Screen page: /emby/QuickConnect/Screen
• Phone page: /emby/QuickConnect/Page

Step 5: Sign in on a TV browser or computer

1. On the Emby sign-in screen, click Sign in with your phone, or open the screen page. The screen shows a 6-digit code and a QR code.
2. On the phone, scan the QR code, or open the phone page and type the code.
3. Check the name of the device that is waiting, then approve with one tap as the Emby user already signed in on the phone, or use Another account with a username and password.
4. The screen signs in by itself and is sent to the address set by the admin (default: the server's web UI).

Step 6: One-time codes for the official Emby apps

On TVs and consoles where the official Emby app is the only client, there is no screen page. The one-time code covers that case:

1. On the phone, open the phone page while signed in to Emby and turn on codes for my account once.
2. Click Show a code whenever you need one.
3. In the Emby app, sign in with your username and type the 6-digit code in the password field.

The code is valid for 5 minutes and works once. This is opt-in per user, and the normal password keeps working. If the plugin is removed or the license ends, Emby goes back to checking the normal password by itself.

Security notes

• Screen codes are random, single-use, and only the screen that asked for the code receives the session. One address can have at most 5 codes waiting at a time.
• 10 wrong attempts from one address within 10 minutes block that address for 10 minutes; a one-time app code is canceled after 5 wrong tries.
• Disabled accounts are refused, and so are accounts without remote access when the screen is outside your local network.
• One-time app codes are stored only as a hash, in memory: restarting Emby cancels every waiting code.
• Every sign-in by code is logged with user, device, app and who approved it.
• QR codes are generated on the server; the only external service is the licensing client. Session tokens are written to browser storage before the redirect, never put in the URL.

Tips and troubleshooting

• The button does not appear on the sign-in screen: apply it from the panel, run the command it shows if Emby cannot write the file, then reload the sign-in page. After an Emby update the plugin puts it back at start-up; if that fails, the panel shows the error.
• "The code is not valid or has expired": check the digits on the screen; codes last a few minutes and work once. Ask the screen for a new one.
• "Too many attempts": wait 10 minutes; the block applies to the address that made the wrong attempts.
• "The account is not allowed to sign in from outside the local network": the account has no remote access in Emby and the screen is outside your network.
• The app code is refused: turn on codes for the account first, use a fresh code, and check that one-time codes are on in the panel.
• Ending a session: use Emby's own Devices page.

The admin panel also lists the users with app codes and the recent sign-ins, so you can see who signed in, from which device and app, and how it was approved.

Conclusion

Quick Connect turns TV sign-in from a remote-control typing exercise into a scan and a tap, and gives the official apps a one-time code path without weakening the normal password. Install it, set the code lifetime and the admin block to your liking, apply the sign-in button, and your users stop asking you for passwords. The full walkthrough is in the user guide; the product page has the feature list and the changelog tracks changes. Questions are welcome at contact, and the knowledge base and FAQ cover the rest of our plugins.