# qURL CLI — share a local app without putting it on the internet > Keep local apps hidden from public scans. Publish with one command, then give people and AI agents private, expiring access. No inbound ports. Source: https://layerv.ai/cli/ --- qURL™ CLI # Securely publish your local apps and APIs. One command turns a local app or API into a securely shareable resource. Keep it hidden from public scans. Give a teammate or AI agent a private way in — without a staging server, public DNS, or an inbound port. [Get started](https://layerv.ai/start/) [qURL CLI](https://github.com/layervai/qurl-integrations/blob/main/apps/cli/README.md) ## Make it available to the people and agents you choose without exposing it to the public internet. ## Install, sign in, publish, share. Four steps from a running local app to a private link. 1. ### Install the CLI `brew install layervai/tap/qurl` 2. ### Sign in If the CLI reports missing connection settings, [get a deployment file from LayerV](https://layerv.ai/contact/) and set `QURL_DEPLOYMENT` to its path before signing in. Custom deployments also need this file. `qurl login` Paste your account API key at the hidden prompt. The CLI enrolls this machine, saves a restricted device credential, and discards the account key. Select `qurl:agent` and `qurl:resolve` when you create the key. [Don’t have a key?](https://layerv.ai/qurl/dashboard/keys/) 3. ### Publish your app Start your HTTP app on 127.0.0.1 first. Keep it running, then use a second terminal. Replace 3000 with your app’s port. `qurl publish http://127.0.0.1:3000` The command prints your full CRID when the route is ready. Sharing continues in the background while your app and host are running. 4. ### Send someone a link `qurl share ` Replace with the full value printed in step 3, without the brackets. Send the returned link privately. The **CRID** names the resource; the link grants access. The recipient opens it in a browser without a LayerV account or CLI. Your app’s own sign-in still applies. How it protects ## Nothing to find. Nothing to leave open. ### Links that expire on their own You run `qurl share` to mint a short-lived access link, then send it. Expiry prevents new redemption; an open session has its own lifetime. ### No inbound ports Traffic is outbound only — HTTPS to api.layerv.ai and NHP over UDP 443\. No inbound port forwarding is needed. Your network must allow the required outbound traffic. ### No staging server to provision Keep your app running; the CLI serves it in the background. Use `qurl stop` to pause access, `qurl start` to resume, or `qurl delete` to retire the resource. ## The demo, without the exposure. ### Show work in progress Let a team member or client click through the branch running on your laptop — without a staging deploy and without a public address for it. ### Give an agent a local target Publish the service on your machine, then hand an AI agent a qURL scoped to that one resource and nothing else. ### Hand a contractor one thing Publish the single API they need and send them a link. They reach that resource under the link and session limits you set, without joining your network. ### Protect something already remote `qurl publish` also accepts a remote HTTPS URL. It adds an access path through LayerV; the original URL stays reachable unless you restrict it. Running a production service ## Use the CLI daemon beside your service. The connector runs inside the qURL CLI. Production deployments need: - A service manager or container runtime that keeps the daemon running - Persistent, restricted device state across restarts - Deployment configuration and secure enrollment credentials [CLI deployment reference ↗](https://github.com/layervai/qurl-integrations/blob/main/apps/cli/README.md#qurl-daemon-run) ## FAQs Does this put my app on the public internet? No — an app listening on 127.0.0.1 stays off the public internet. The CLI connects outbound to LayerV and opens no inbound port. Close or restrict any separate public route your app already exposes. What is a CRID? Your stable handle for the lifetime of a published resource. It identifies the resource but grants no access, and only you — the owner — can turn one into an access link. What you hand to other people is the link, not the CRID. So how does someone actually get in? You run `qurl share` on the CRID, which mints a short-lived qURL, and you send them that link. They open it in a browser without installing the CLI or creating a LayerV account. The link grants access to its holder; your app’s own sign-in still applies. For a download in your own script, run `qurl get` --file . Do not curl the share link: that fetches the browser opening page, not the app content. Do I have to open a firewall port? No. Traffic is outbound only — HTTPS to api.layerv.ai and NHP over UDP 443\. No inbound port forwarding is needed; your network must allow the required outbound traffic. What happens when I stop the command? `qurl publish` exits when the route is ready. A background daemon serves the local app while the app and host are running. Use `qurl stop` to stop sharing, or `qurl start` to resume. With --foreground, Ctrl-C stops serving. Which platforms does it run on? Local publishing works on macOS, Linux, and Windows. Install the latest release for your operating system and architecture. On Linux, background publishing uses systemd user services; use --foreground when a user service manager is unavailable. How is this different from a public tunnel? A public tunnel exposes an endpoint and can protect it with authentication. With LayerV, your local app stays hidden from public scans. You create a private, expiring way in for one resource at a time. A teammate or AI agent can use the app without a public deployment or access to your wider network. Is the hiding built on a standard? Yes. qURL builds on OpenNHP, the Network Hiding Protocol specified by the Cloud Security Alliance. The CLI handles the protocol exchange for you. OpenNHP is open source, and its IETF work is an Internet-Draft rather than an adopted IETF standard. ## Publish your first app. Keep your app on your machine. Give people and agents access on your terms. [Open the quickstart ↗](https://layerv.ai/start/) [API reference](https://layerv.ai/docs/) [Source](https://github.com/layervai/qurl-integrations) --- *This markdown version is auto-generated from [https://layerv.ai/cli/](https://layerv.ai/cli/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*