qURL™ CLI
Securely publish
your local apps and APIs.
One command turns a local app or API into a securely shareable resource. Keep it hidden from public scans. Give a teammate or AI agent a private way in — without a staging server, public DNS, or an inbound port.
Make it available to the people and agents you choose without exposing it to the public internet.
Install, sign in, publish, share.
Four steps from a running local app to a private link.
Install the CLI
brew install layervai/tap/qurlSign in
If the CLI reports missing connection settings, get a deployment file from LayerV and set
QURL_DEPLOYMENTto its path before signing in. Custom deployments also need this file.qurl loginPaste your account API key at the hidden prompt. The CLI enrolls this machine, saves a restricted device credential, and discards the account key. Select
qurl:agentandqurl:resolvewhen you create the key. Don’t have a key?Publish your app
Start your HTTP app on 127.0.0.1 first. Keep it running, then use a second terminal. Replace 3000 with your app’s port.
qurl publish http://127.0.0.1:3000The command prints your full CRID when the route is ready. Sharing continues in the background while your app and host are running.
Send someone a link
qurl share <CRID>Replace <CRID> with the full value printed in step 3, without the brackets. Send the returned link privately. The CRID names the resource; the link grants access. The recipient opens it in a browser without a LayerV account or CLI. Your app’s own sign-in still applies.
How it protects
Nothing to find. Nothing to leave open.
Links that expire on their own
You run qurl share to mint a short-lived access link, then send it. Expiry prevents new redemption; an open session has its own lifetime.
No inbound ports
Traffic is outbound only — HTTPS to api.layerv.ai and NHP over UDP 443. No inbound port forwarding is needed. Your network must allow the required outbound traffic.
No staging server to provision
Keep your app running; the CLI serves it in the background. Use qurl stop <CRID> to pause access, qurl start <CRID> to resume, or qurl delete <CRID> to retire the resource.
The demo, without the exposure.
Show work in progress
Let a team member or client click through the branch running on your laptop — without a staging deploy and without a public address for it.
Give an agent a local target
Publish the service on your machine, then hand an AI agent a qURL scoped to that one resource and nothing else.
Hand a contractor one thing
Publish the single API they need and send them a link. They reach that resource under the link and session limits you set, without joining your network.
Protect something already remote
qurl publish also accepts a remote HTTPS URL. It adds an access path through LayerV; the original URL stays reachable unless you restrict it.
Running a production service
Use the CLI daemon beside your service.
The connector runs inside the qURL CLI. Production deployments need:
- A service manager or container runtime that keeps the daemon running
- Persistent, restricted device state across restarts
- Deployment configuration and secure enrollment credentials
FAQs
Does this put my app on the public internet?
No — an app listening on 127.0.0.1 stays off the public internet. The CLI connects outbound to LayerV and opens no inbound port. Close or restrict any separate public route your app already exposes.
What is a CRID?
Your stable handle for the lifetime of a published resource. It identifies the resource but grants no access, and only you — the owner — can turn one into an access link. What you hand to other people is the link, not the CRID.
So how does someone actually get in?
You run qurl share on the CRID, which mints a short-lived qURL, and you send them that link. They open it in a browser without installing the CLI or creating a LayerV account. The link grants access to its holder; your app’s own sign-in still applies. For a download in your own script, run qurl get <CRID> --file <path>. Do not curl the share link: that fetches the browser opening page, not the app content.
Do I have to open a firewall port?
No. Traffic is outbound only — HTTPS to api.layerv.ai and NHP over UDP 443. No inbound port forwarding is needed; your network must allow the required outbound traffic.
What happens when I stop the command?
qurl publish exits when the route is ready. A background daemon serves the local app while the app and host are running. Use qurl stop <CRID> to stop sharing, or qurl start <CRID> to resume. With --foreground, Ctrl-C stops serving.
Which platforms does it run on?
Local publishing works on macOS, Linux, and Windows. Install the latest release for your operating system and architecture. On Linux, background publishing uses systemd user services; use --foreground when a user service manager is unavailable.
How is this different from a public tunnel?
A public tunnel exposes an endpoint and can protect it with authentication. With LayerV, your local app stays hidden from public scans. You create a private, expiring way in for one resource at a time. A teammate or AI agent can use the app without a public deployment or access to your wider network.
Is the hiding built on a standard?
Yes. qURL builds on OpenNHP, the Network Hiding Protocol specified by the Cloud Security Alliance. The CLI handles the protocol exchange for you. OpenNHP is open source, and its IETF work is an Internet-Draft rather than an adopted IETF standard.
Publish your first app.
Keep your app on your machine. Give people and agents access on your terms.