# Give a contractor temporary access to your app > Give a contractor temporary access to a local app: invite them by email with the qURL skill, or send a link that expires. End access with one command. Source: https://layerv.ai/guides/give-a-contractor-temporary-access/ --- [← All guides](https://layerv.ai/guides/) # Give a contractor temporary access to your app Checked against the qURL™ CLI 3.4.1 source and documentation on October 14, 2026. Link and session behaviour is [tested separately](https://layerv.ai/research/qurl-behaviour/). Content updated October 18, 2026. The verification date above records the original review; later behaviour checks are dated in the guide. ## How do I give a contractor temporary access to an app running on my machine? For a named contractor, have your coding agent publish the app privately with the qURL skill and send them an email invitation; they verify their email and save a passkey. For a single visit, run qurl publish, then qurl share with --ttl and --session-duration. End access with qurl stop or qurl delete, or by revoking the invitation. ## What you need - The app running on the machine where you run qurl publish - The qURL CLI 3.4.1 or later - For an email invitation: a coding agent with the qURL skill, and the contractor’s email address - No account or API key ## Steps 1. ### Choose an invitation or a link An email invitation names the contractor: they verify their email and save a passkey, and strangers cannot request access. A one-time link is a secret that lets in whoever opens it first, once, before it expires. For work that runs over several days, invite them; for one walkthrough, send a link. 2. ### For a named contractor: ask your agent to invite them Install the qURL skill in your coding agent first; the agent guides show where each one reads it. The agent applies the private access rules you choose. For named recipients, give it their email addresses so it can send invitations. Recipients verify their email in the browser and save a passkey; they never send you their email verification code. The agent checks policy support before sharing and keeps the app private if the deployment cannot support it. Give the contractor the address the agent prints, with this note: open the emailed invitation in a browser, verify your email there, and set up your passkey. ``` Share the app I'm running with qURL, invite-only, and invite contractor@example.com. ``` 3. ### Install the qURL CLI On macOS, install it with Homebrew. On Linux and Windows, download the package for your platform from the latest release; the CLI page lists each one. Nothing asks you to sign up. ``` brew install layervai/tap/qurl qurl --version ``` 4. ### For a single visit: publish the app The first publish creates this device’s identity, starts a background service that keeps serving after you close the terminal (while you stay logged in), and prints the app’s CRID, its stable ID. The Access row says who can open the app: a plain publish makes it private from qurl 3.4.1 on. qurl share turns the CRID into an access link, and the link is what you send. ``` qurl publish http://127.0.0.1:3000 ``` Published Target: http://127.0.0.1:3000 Access: private — only you and the people you allow can open it Status: serving CRID: ae4jqpd7eaoslq7jinmjv4yikgzmcxgpjfsuobiniqnko32lpw743ivbeyha 5. ### Create a link with a deadline With no flags the link opens once and expires within 24 hours. --ttl shortens how long an unopened link lasts, and --session-duration sets how long the contractor can work once it is open, from the 1-hour default up to 24 hours. An expired link does not end a session that is already open, so pick the session length you mean. ``` qurl share --ttl 4h --session-duration 2h ``` 6. ### Send the link to one person Send it in a direct message, not a public channel: whoever opens it first uses it. Avoid email and apps that preview links, because a scanner that runs the page could use its one opening. Don’t open it yourself to check it, for the same reason. Run qurl share again whenever you need a fresh link. 7. ### End access when the work is done For an invitation, ask your agent to revoke it: that removes the invitation and the access it granted. For links, qurl stop stops serving the app and qurl start resumes it. qurl delete retires the resource for good after asking you to confirm: existing links stop working and its CRID can never be shared again. The revoke guide covers each way access ends. ``` qurl stop # pause; qurl start resumes qurl delete # permanent; asks you to confirm ``` ## What the recipient sees An invited contractor opens the emailed invitation in a browser and sees who published the app, marked Not verified: today LayerV has verified only its own account. They verify their email there and save a passkey; their email verification code stays in that flow. A contractor with a one-time link lands on your app directly. Either way, the session admits the network address they connect from, and your app’s own sign-in still applies. ## Which tool fits temporary access for a contractor? | Option | Choose it when | Trade-off | | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | [qURL](https://layerv.ai/cli/) | qURL fits when you want particular people to open the app running on your machine, with no account and no public URL. | With qURL your computer and the app must stay running, and each person needs a link or an invitation from you. | | [ngrok](https://layerv.ai/compare/qurl-vs-ngrok/) | ngrok fits when you need a stable public URL, for example for webhooks, or want ngrok’s OAuth or IP rules in front of the app. | ngrok needs an account and authtoken first, the URL is public, and free-plan browser visitors see a warning page. | | [Cloudflare Quick Tunnels](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) | A Cloudflare Quick Tunnel fits when you want a throwaway URL with no account, optionally behind an email PIN with --allowed-mail. | A Cloudflare Quick Tunnel is public unless you set --allowed-mail, gets a new hostname each run, and does not support Server-Sent Events. | | [Tailscale Funnel](https://layerv.ai/compare/qurl-vs-tailscale-funnel/) | Tailscale Funnel fits when the machine is already on a tailnet and you want a stable public HTTPS name for it. | Tailscale Funnel needs a tailnet, makes the app public on a ts.net hostname, and puts no access control on Funnel traffic. | ## Troubleshooting | If you see | Do this | | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The private-policy commands are unavailable or consumer access is disabled | Ask the agent to follow the access-policy support check in the qURL skill. It updates an older CLI when needed. If the deployment cannot support the requested policy, stop sharing and keep the app private; do not fall back to legacy access requests. | | The contractor says the invitation never arrived | Ask the agent to list the resource’s invitations and check the address. An accepted send means the mail service took the message, not that it reached the inbox or that the contractor enrolled. | | qurl publish says the local app is not accepting TCP connections | Start the app first and check that curl works on the same address. qurl publish connects to localhost as 127.0.0.1, so if your app listens only on IPv6 (on macOS or Linux, lsof -iTCP -sTCP:LISTEN -nP shows \[::1\]), publish 'http://\[::1\]:PORT' instead. Keep the quotes: zsh treats the brackets as a pattern. | | The recipient sees “Access link invalid” | The link was already used or has expired. Run qurl share again and send the new link. | | The recipient sees “Resource not found” | The resource was deleted after the link was made. Publish the app again, then run qurl share and send the new link. | | publish rejects http://127.0.0.1 with “only HTTPS URLs are allowed”, or asks you to log in | You have a CLI older than 3.0\. On macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. After updating, qurl --version should print 3.4.1 or later. | | publish prints no Access: line, or the Access: line says public and you did not ask for public | With no Access: line, the CLI is older than 3.4.1: on macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. A resource that an older CLI published is public unless you published it with --private, and anyone who has the CRID of a public resource can open it. To make a public resource private, run qurl delete and publish again with qurl 3.4.1 or later. The new resource is private and has a new CRID. | | publish says this Linux session “can’t reach a systemd user manager” | You are in a container or sandbox without a user service manager. Run qurl publish with --foreground; sharing lasts as long as that process runs. | | publish says “Quota Exceeded” with “protected resource limit reached”, or “Your qURL account has reached a plan limit” | You can see this without an account: a device with no account can keep up to 3 active resources, with links that last up to 24 hours. Run qurl list --status active, then qurl delete for any you no longer need (it asks you to confirm; --yes skips that). qurl stop keeps the resource, so it does not free a slot. | ## Frequently Asked Questions Does the contractor need a LayerV account? No. An invited contractor verifies their email and saves a passkey in their browser, and a link opens in a browser with nothing to install. You need no account either; without one you can keep up to 3 active resources, with links that last up to 24 hours. Can the contractor reach anything else on my machine? Not through qURL: access is scoped to the one app you published, not the network around it. Inside that app, the app decides what a signed-in user may do, so give the contractor an account with only the permissions the work needs. Publishing does not close a separate public route the app already has, so keep the app bound to 127.0.0.1. Why use an invitation instead of sending links? A link is a bearer secret: whoever holds it can try to open it, and each one opens once. An invitation names the contractor by email, so you are not sending a fresh secret every day, and strangers cannot request access to an invite-only app. Does my computer have to stay on? Yes. The app is served from your machine, so the machine and the app must be running and connected. The background service reconnects after sleep, but the app is unavailable while the machine is asleep. Who else can reach my app while the link is open? Opening the link admits the network address it was opened from for the session, which lasts 1 hour by default. Other devices that share that public IP address, such as people on the same office or café network or VPN, can reach the app until the session ends. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Keep your app’s own sign-in for anything sensitive. ## Related Resources [Guide: Revoke access to a shared app →](https://layerv.ai/guides/revoke-access-to-a-shared-app/) [Guide: Make a one-time link for a demo →](https://layerv.ai/guides/one-time-link-for-a-demo/) [Guide: Share a dev server with a client →](https://layerv.ai/guides/share-dev-server-with-client/) [ngrok alternatives with authentication →](https://layerv.ai/compare/ngrok-alternatives-with-auth/) [qurl.link: share with one person ↗](https://qurl.link/share-with-one-person) [Use case: contractor and vendor access →](https://layerv.ai/use-cases/contractor-vendor-access/) [LayerV vs Cloudflare Access →](https://layerv.ai/compare/layerv-vs-cloudflare-access/) [Guide: Give an AI agent access to a local app →](https://layerv.ai/guides/give-an-ai-agent-access-to-a-local-app/) [The qURL skill →](https://layerv.ai/skills/qurl/SKILL.md) ## Publish your app now Install the CLI, then run one command. No sign-up, no API key. [Install the CLI ↗](https://layerv.ai/cli/) --- *This markdown version is auto-generated from [https://layerv.ai/guides/give-a-contractor-temporary-access/](https://layerv.ai/guides/give-a-contractor-temporary-access/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*