or open a preset in the Patches tab
For sites without CORS headers (satellites, terrain, station schedule). {url} is replaced by the encoded address; without it the address is appended to the prefix as is. Your own Node bridge does it too (node tools/node/bridge.mjs): http://127.0.0.1:8777/proxy?token=…&url={url} — streams, Range, no third party sees your addresses. Or just @name of a bridge from the Devices tab.
Bridges you use: a phone with the DSP app, a Raspberry Pi or PC with the Node bridge. A node takes @name in its address field; the token stays in this browser (not in patches, shares or backups).
A page on https can open wss:// only with a certificate the browser trusts. Make your own CA once, trust it on the device where this page runs, then make a certificate for each bridge. The Node bridge does it itself: node tools/node/bridge.mjs --tls.
A phone with the DSP app makes its own key and never sends it: this page signs a certificate for the phone's public key and sends back the certificate only. Names / IPs above (empty — the address of the device).
Logins you reuse: once here — any node takes one by name in its account field (Messenger, and the like). Passwords stay in this browser (not in patches, shares or backups).