How to connect a Jellyfin server to the iPhone app

To connect your Jellyfin server to the iPhone app, open Ensō, type the server's address, approve the code Ensō shows with Quick Connect (or sign in with your password) and allow local network access if iOS asks. This guide walks through each step.

What you need before you start

• A Jellyfin server that is running, yours or one that someone you know runs. Ensō has no servers or content of its own.
• A user on that server, with a password or without one.
• The server's address: its IP address on your network, or its domain name if it can be reached from outside.
• An iPhone or iPad with iOS 16 or later.

Connect your Jellyfin server to the iPhone app, step by step

1. Open Ensō. On a fresh install you land on Connect to Server: one field for the address and a Connect button.
2. Type your server's address, for example 192.168.1.50 or media.example.com, and tap Connect. The next section says what you can type.
3. If iOS asks whether Ensō may find and connect to devices on your local network, allow it. If the first attempt fails while the question was on screen, tap Connect again.
4. Ensō shows a short code under Sign in with this code. Open your server's web page in a browser (on iPhone and iPad, Open in Browser does that for you), sign in as the person who will use the app, open Settings → Quick Connect and type the code.
5. Within a couple of seconds Ensō notices the approval and signs in as the user who approved the code.
6. No browser at hand? Tap Sign in with password instead. If your server has Quick Connect switched off, Ensō shows the password screen by itself after the address. Enter user name and password (leave the password empty if the user has none) and tap Sign In.
7. Home appears. Ensō saves the sign-in, so from now on it opens straight into your library.

Because you approve the code in a session where you are already signed in, it also works when your server uses single sign-on (SSO) through a plugin: sign in there the way you always do. If a code no longer works, ask for a new one: tap Sign in with password instead and then Back to Quick Connect. On Apple TV the screens are much the same, plus a field for the name of that Apple TV, which your server shows in its list of devices; the Apple TV page has more.

Which address to type

You can type just an IP address or a name; Ensō works out the rest. Without http:// or https:// in front, it tries the likely variants at the same time and takes the first one that answers within a few seconds. A full address with the scheme in front is used exactly as typed.

Jellyfin's default port is 8096 for plain http, and 8920 for its own https if you switch that on. That is why Ensō adds 8096 when you give no port. If your server listens elsewhere, type the port yourself, for example 192.168.1.50:8097. If it lives under a path (Jellyfin calls this a Base URL), type the whole address, for example https://media.example.com/tv.

http or https: what works

Plain http is how a fresh Jellyfin install answers, and inside your own network it is fine. In Ensō it works with the address of a device in your home network, such as 192.168.1.50, with a single-word name such as http://nas:8096 and with a name that ends in .local. It does not work with a full domain name or a public IP address: iOS blocks unencrypted connections to those (Apple calls the rule App Transport Security), and Ensō does not ask for an exception. For a domain name, and for anything you reach over the internet, use https.

https needs a certificate that iOS trusts, for example one from Let's Encrypt for your domain name. If it has expired, was issued for another name or is self-signed, Ensō refuses the connection, just as Safari warns about it, and Ensō has no switch to ignore that. Jellyfin's own documentation recommends letting a reverse proxy handle https and discourages self-signed certificates.

The Local Network permission on iPhone and iPad

The first time Ensō talks to a server on your home network, iOS asks whether Ensō may find and connect to devices on your local network. Allow it: without that, Ensō cannot reach your home server and says so. The question comes from iOS, not from Ensō, and iOS asks only once. It does not apply to a server that you reach over the internet by a public address, and the Apple TV has no such permission.

If you tapped Don't Allow by mistake, open Settings on the iPhone, then Privacy & Security → Local Network, and switch Ensō on. Apple's support page describes the setting.

Reaching your server away from home

Ensō needs one address that works from where you are. Away from home there are two usual ways to get one:

• A domain name with https, behind a reverse proxy. A reverse proxy is a small web server that takes connections from the internet, handles the certificate and passes requests on to Jellyfin inside your network. Jellyfin's documentation recommends this and shows examples for Nginx, Caddy, Traefik and Apache. The usual setup opens only the proxy to the internet and keeps Jellyfin's own port 8096 inside your network.
• A VPN into your home network. With the VPN on, your server answers at its home address, and you type that. Ensō has no VPN of its own.

Two settings in Jellyfin often decide whether this works. Behind a proxy, add the proxy to Known proxies in the server's network settings: Jellyfin warns that external access settings only work with a reverse proxy if that is set up correctly. And Jellyfin can forbid remote connections for single users (Allow remote connections to this Jellyfin Server in the user's profile, which blocks sign-ins from outside the networks Jellyfin counts as local), so a user who signs in at home but not away may simply be blocked there.

Several servers and accounts

Ensō can hold as many accounts as you like, on one server or on several. Choose Add Account from the profile menu, from Settings or on the Who's Watching? screen and repeat the steps above. Each account keeps one address. The page about accounts and servers explains what every account keeps apart.

If Ensō cannot connect

“Server unreachable. Check the address and network.” is the message for most problems: Ensō got no answer from any variant of the address within a few seconds, or the server stopped answering while Ensō asked it for a Quick Connect code. Work through this list from the top:

• Open the address in Safari on the same iPhone. The Jellyfin web page should appear. If Safari cannot reach it either, the cause is the network or the server, not Ensō.
• Same network? A home address only works on your home Wi-Fi. Cellular data cannot reach the private addresses of your home network, and a VPN can get in the way.
• Port and firewall. Jellyfin listens on 8096 unless you changed it. The firewall of the machine it runs on, or the port mapping of its container, has to let that through.
• A domain name or public address over http. iOS blocks that, as described above. Use https, or the IP address of a server at home.
• The certificate. Open the https address in Safari. If Safari warns about the certificate, Ensō refuses the connection too.
• Local network access. Check Settings → Privacy & Security → Local Network.
• Works at home, not away. Look at the proxy, the known proxies and the user's remote access setting, as described above.

Once Ensō is connected, a server that stops answering shows the bar Offline – only downloads are available, and Ensō keeps trying. On iPhone and iPad you can still watch what you saved; see offline downloads. If the server turns the saved sign-in down, you see Sign-in expired with a button to sign in again.

What Ensō keeps, and what it tells your server

Ensō saves the address, the user name and the access token that Jellyfin issued in the iOS Keychain, and never the password. Apart from a report you choose to send us, it sends nothing anywhere but to the server you entered. Your server sees the app's name and version, the device's name and your requests; it lists the device under Devices in the dashboard, and while the app is open it announces itself as a player that other clients can control; that is how the Apple Watch remote finds it. Sign Out in the app asks the server to end that sign-in. What is stored where is described on the accounts page.

Server-side details checked against Jellyfin's documentation on 7 October 2026: Quick Connect and Networking.

Questions about connecting

Does Ensō support Quick Connect?

Yes, and it is how connecting a new account starts: Ensō shows a code, and you approve it in the Jellyfin web interface under Settings → Quick Connect. If the server has Quick Connect switched off, Ensō goes straight to the password screen instead. If you prefer a password anyway, tap Sign in with password instead on the code screen.

Do I need to open a port on my router?

Not for a server that you reach on your home network. For use away from home you need a way in: a domain name with https behind a reverse proxy, or a VPN into your home network.

Why does iOS ask about the local network?

Because your server is a device on your local network, and iOS asks before an app talks to one. It asks once, the first time. If you said no, switch it on under Settings → Privacy & Security → Local Network. The Apple TV has no such question.

Can I use a self-signed certificate?

Ensō has no option to accept a certificate that iOS does not trust. Use a certificate from a public authority, for example through a reverse proxy, or connect with a plain http address inside your home network.

Can I connect to more than one server?

Yes. Every account belongs to one server, and you can add as many accounts as you like. See accounts and servers.

Which port does Ensō use?

If you give none, Ensō tries the standard ports of https and http and, for http, Jellyfin's default port 8096. If yours is different, type it after the address, for example 192.168.1.50:8097.

Related