What is a Capability URL?
A capability URL encodes the authority to reach a resource in the link itself, so possession of the link is the credential. It is not bound to a named recipient unless the application adds an identity check.
Useful distinctions:
- Bearer vs requester-bound: A bearer capability URL grants access to whoever holds it; a requester-bound grant is limited to a specific identity
- Resource scope: The link permits one published resource, not the surrounding network or every action on it
- Use limits: Single-use is optional; a link can allow a bounded number of sessions
- Expiry vs session duration: Link expiry stops new redemption; an open session has its own lifetime
A capability URL is a credential. Treat it as a secret, and revoke it when access should end early.
How LayerV Implements This
A qURL is a bearer capability URL for one published resource. Issue it through the CLI, SDKs, or API with the expiry and supported use limits the task needs, and keep application sign-in when the opener’s identity must be verified.