FAQ
Your LayerV questions, answered.
From your first access link to a running service. Find answers about LayerV and the qURL™ CLI, SDK, and API.
Getting started
What can I do with LayerV?
Keep an app or API off the public internet and let your code create access for each person or AI agent task. LayerV checks authorization before opening the protected origin connection. Publish a resource once, then create access links for the work that needs to happen. A development preview, internal dashboard, or private API is a good place to start.
How do I start with LayerV?
Create an account, get an API key, and install the qURL CLI. Run qurl login and complete device enrollment. Start a local HTTP app, run qurl publish for its address, then use the returned resource identifier with qurl share. Send the resulting access link to your recipient. The quickstart walks through these steps with a local example.
What do I need before publishing?
You need a running HTTP service, a host that can reach it, and a LayerV account. For the local publishing workflow, install the latest qURL CLI release and run qurl login. The publishing host needs outbound connectivity to LayerV; the app can stay on localhost or a private network.
Does the recipient need a LayerV account?
For browser access, no. Send the access link and the recipient opens it in their browser without installing the CLI or creating a LayerV account. If your application has its own login, that login still applies. Programmatic clients use the appropriate SDK or API opening flow.
How do I check the recipient experience?
Create a fresh link and open it in a separate browser session. Check the app, its login, redirects, and any supporting assets. If you are using a single-use link, create another link before sending it to the recipient: your test may have used the first one.
Publishing resources
What is the difference between publish and share?
Publish creates the resource and its protected access path. For a local app, the CLI starts a connector so the app can stay on your machine or private network and be reached through qURL. Share creates an access link for that resource, which you send to a person or agent. Publishing does not announce the app to the public internet or send it to LayerV as a recipient.
Does publishing move my application to LayerV?
No. In the local publishing workflow, your app continues running on your own host. The CLI registers the resource and runs the connector that carries access traffic between LayerV and your app. LayerV provides the access service; it does not become the host of your application code or replace the machine serving it.
What is a CRID, and what do I send to someone?
The CRID is the stable cryptographic identifier printed when you publish a resource. It is derived from the resource public key and identifies the resource independently of its network address. Compatible openers use it to verify signed access grants. Use it to manage that resource and to create links with qurl share. It identifies the resource but does not itself grant access. Send the access link returned by share to the recipient.
Can I publish an app on localhost?
Yes. Publish the local HTTP address where your app is listening. The embedded connector reaches the app from the publishing host and connects outbound, so you do not need to expose the app through an inbound firewall port. Keep the app, host, and connector running while recipients need access.
Will publishing a public URL make its original address private?
Publishing a remote URL adds an access path through LayerV. To make that path the only way in, the original service must also be private or restricted. For a new local deployment, bind the app to localhost or a private network and publish it through the connector. For an existing public app, close or restrict its separate public route.
What do stop, start, and delete do?
Use qurl stop <CRID> to pause local serving while keeping its CRID, and qurl start <CRID> to resume it. Use qurl delete <CRID> to retire the resource identity; publishing again creates a new resource. Use individual link revocation when you want to withdraw one shared link while leaving the resource available for other work.
Sharing, expiry, and sessions
Can I create separate links for different people or tasks?
Yes. Publish once, then create fresh links for the same resource as needed. Give each task an appropriate lifetime and keep the link as carefully as you would a password. Separate links let you withdraw one grant of access without replacing the resource or every other link.
Is an access link tied to the person I send it to?
A standard access link grants access to whoever holds it, subject to its limits and policy. Sending it to a named person does not by itself verify who opens it. Keep your application sign-in when you need to identify the user, and use link expiry and use limits to control how the link can be used.
Are all links single-use?
Use limits depend on how the link is issued and the options the service supports. A single-use link can be redeemed once. That redemption can establish a session in which the app makes many HTTP requests; it does not mean the recipient can load only one page or make one API call.
What is the difference between link expiry and session duration?
Link expiry sets the deadline for opening a new session with the link. Session duration controls how long the access established by a successful opening lasts. A session opened just before the link expires can continue for its permitted duration. Set both limits to match the access window you want.
Can I revoke one link without deleting the resource?
Yes. The API has separate operations for revoking an individual link and terminating live sessions. You can withdraw access while keeping the resource and other links. A caller should check the response and complete any requested retry if session cleanup is still pending.
Why might an access link fail to open?
The link may have expired, reached its use limit, been revoked, or failed an access policy. The resource may also be stopped or its host offline. Ask the owner to check the resource and issue a fresh link if appropriate. If a fresh link also fails, use the error and request ID when contacting support; do not post the secret link publicly.
What should I save after creating a link?
Keep the resource identifier and the identifier returned for the individual link if you will need to revoke it later. Deliver the secret link through a private channel. The resource identifier is reusable for issuing more links; a secret link should not be placed in public logs or source control.
Developers and AI agents
Which developer tools can I use?
Use the qURL CLI to publish from your machine, the Go, TypeScript, or Python SDK to add access to application code, the REST API for direct calls, and the MCP server for agent tools. A common workflow is to publish a resource once and let your application issue fresh links as people or agents need them.
Can an AI agent open an access link without a browser?
Yes. Headless access means software opens the link without an interactive browser. For full qURL links, the Go SDK provides EnterPortal, which verifies the link and returns a handle for requests to the resource. The REST API also has a token-resolution endpoint for its supported access tokens. Use the documented opening flow for the kind of link or token you received.
Can I open any qURL link with a normal HTTP request?
A full qURL link carries access information in its URL fragment, the part after #. A plain HTTP request does not send that fragment to the server. A browser runs the opening flow; software should use a compatible SDK opener. After access is granted, use the returned resource URL and the documented session authorization for content requests.
Is headless access the same as headless agent enrollment?
No. Opening a link gives software access to a resource. Enrollment registers the service or agent itself. The Go enrollment guide offers an interactive email-code flow and a headless flow using a short-lived enrollment token. Use headless enrollment for a service that cannot ask an operator to enter a code.
What can an MCP agent do?
The qURL MCP server exposes tools to create resources and links, mint another link for an existing resource, resolve supported access tokens, and revoke links or sessions. The agent can call those tools within the permissions of the configured credential. The MCP guide demonstrates a configured URL. Use the CLI, SDK, or API flow to issue links for a locally published resource; the shown MCP release does not accept CLI CRIDs in its mint_link tool.
Which credential should automation use?
Use an account API key with the permissions needed to manage resources or issue links. Enrollment tokens register agents or connectors; enrolled device credentials identify those running components. An access link is the credential you give a recipient for one resource. Keep account keys on your server or in secret storage rather than giving them to link recipients.
Do SDK and API calls publish my local app automatically?
The link-issuing examples create access for a resource that has already been set up. They do not start a connector on your laptop. Publish a local app with the CLI first, or follow the connector deployment guide, then use the resource identifier to issue access links from your code.
Identity and security
Do access links replace application login?
LayerV controls the path into a resource. Your application can continue using its own login and permissions to decide who the user is and what they may do. This lets you hide the application from unsolicited internet traffic while retaining the authentication your users already know.
Can I keep my existing identity provider?
Yes, you can keep the identity provider used by your application, including its existing sign-in experience. An application can also issue access links after an authorized user signs in. If you need the eventual opener to prove that identity, keep a sign-in check at the application; issuing the link after login alone does not make it non-transferable.
What stays hidden when I publish a local app?
The private origin has no direct public route. LayerV checks authorization before opening the protected origin connection, so a scanner without access cannot reach the app through that path to fingerprint its software or probe its routes. Shared LayerV services remain reachable. Keep other public listeners and routes to that app closed so requests go through the protected access path.
Do I still need patches, monitoring, and backups?
Yes. LayerV reduces the application’s exposure to unsolicited traffic. Continue maintaining the app, protecting credentials, monitoring activity, and backing up data. Hiding the route into an application works alongside those controls.
Deployment and operations
What is the connector?
The connector is the component beside your app that connects it to LayerV’s access service. It can reach the app locally and establishes an outbound connection. In the qURL CLI publishing workflow, the connector is embedded in the CLI, so you do not need to install a separate connector to try a local app.
Do I have to leave a terminal open?
By default, qurl publish starts background serving and returns when the route is ready. Your terminal can close while the background process continues. If you choose --foreground, the command stays attached to the terminal and Ctrl-C stops serving. In either mode, the app and publishing host must stay running.
What happens if my laptop sleeps or loses its connection?
The app is unavailable through that host while the host is asleep or disconnected. The CLI can recover when the host wakes or reconnects, but it cannot serve requests during that interruption. For an app others rely on, use a host that stays awake and connected.
How should I run a service that needs to stay available?
Run the app and connector on a host intended for continuous operation, with persistent credential state and process supervision. Follow the deployment guide for your environment and test restart and reconnection. A laptop is useful for a preview; a continuously used application needs a continuously available publishing host.
Does publishing require inbound firewall ports?
The connector connects outbound, so a local app does not need a new inbound firewall port for recipients. The host still needs to reach the app and the required LayerV services. The CLI guide lists the network requirements, including HTTPS and NHP connectivity.
Architecture and OpenNHP
How is LayerV different from a VPN?
LayerV lets you give someone access to one published app or API through a link. Browser recipients do not need to join a private network or install a VPN client. You can create a fresh link for a contractor, customer, or agent task and set its access window without handing out broader network access.
How is LayerV different from ngrok or Cloudflare Tunnel?
ngrok and Cloudflare can connect private origins and apply authentication policies. LayerV combines a cryptographic resource identity with signed access grants and authorization before the origin connection opens. Publish once, then let your code issue access for one resource and task. The CRID names the resource; a separate link grants access. Outbound transport alone is not the distinction.
What is the relationship between LayerV and OpenNHP?
The LayerV team are core builders of OpenNHP, the open-source network-hiding technology. LayerV is the enterprise implementation, bringing that foundation into a managed access service and developer tools. Our founding team co-authored the CSA specification; the protocol is also documented in an IETF Internet-Draft.
Pricing and support
How much does LayerV cost?
LayerV has a free tier so you can start publishing and sharing access. The pricing page lists the current offer. For larger deployments, discuss your resource count, usage, and support requirements with the team.
Can I discuss an enterprise deployment?
Yes. Tell us which apps and APIs you want to protect, who or what needs access, and where the services run. The team can help you work through the deployment, identity, operations, and support requirements for your environment.
Where should I ask for help?
Start with the guide for your tool, then contact the team with the tool version, the operation that failed, and any error or request ID. Remove API keys, enrollment tokens, access links, and other secrets before sharing logs. Include whether the resource is local or remote and whether browser or programmatic access failed.
More questions? Read the quickstart or contact our team.
Ready to make your infrastructure invisible?
Start building for free today.