Revoke access to an app you shared
Checked against the qURL™ CLI 3.4.1 source and documentation on October 14, 2026. Link and session behaviour is tested separately.
Content updated October 18, 2026. The verification date above records the original review; later behaviour checks are dated in the guide.
How do I take back access to an app I shared with qURL?
A link from qurl share with no flags opens once and expires within 24 hours on its own. To end access sooner, run qurl stop <CRID> to stop serving the app (qurl start <CRID> resumes it) or qurl delete <CRID> to retire it for good. With an account, revoke one link through the API while the others keep working.
What you need
- An app you published with qurl publish, and its CRID
- The qURL CLI 3.4.1 or later
- For revoking one link through the API: a LayerV account and API key
Steps
Find the CRID
Every command that ends access takes the app’s CRID, which qurl publish printed. qurl list --status active lists the resources this device published.
qurl list --status activeLet unused links run out
A link from qurl share with no flags opens once and expires within 24 hours, so an unopened link ends on its own. A session that is already open runs until it ends, 1 hour by default: an expired link does not end it. For the next link, keep both short.
qurl share <CRID> --ttl 1h --session-duration 30mStop serving the app
qurl stop pauses serving the app and keeps the resource and its CRID; qurl start resumes it. A stopped app still counts toward your resource limit.
qurl stop <CRID>Delete the resource for good
qurl delete asks you to confirm, then retires the CRID: existing links stop working, people you let in lose their way in, and the CRID can never be shared again. Publishing the same app again gives it a new CRID.
qurl delete <CRID>Revoke one person’s invitation
If you invited people by email through the qURL skill, ask your agent to revoke one person’s invitation. That removes the invitation and the access it granted.
Revoke contractor@example.com's qURL invitation to the app.Revoke one link through the API
With an account, revoke a single link while the resource and its other links keep working. Use GET /v1/resources/{id}/qurls to find the qurl_id, or store it when you create the link. Revoking a link can also end the live sessions it opened; if the API returns a retryable failure, follow its retry guidance.
curl -X DELETE https://api.layerv.ai/v1/resources/<id>/qurls/<qurl_id> \ -H "Authorization: Bearer $QURL_API_KEY"
What the recipient sees
A used or expired link shows “Access link invalid”. An unused link to a deleted resource lands on “Resource not found”. An invited person whose invitation you revoked loses the access it granted.
Troubleshooting
| If you see | Do this |
|---|---|
| Someone still reaches the app after their link expired | Their session is still open: an expired link does not end a session already in progress. Run qurl stop <CRID> to stop serving the app, and give the next link a shorter --session-duration. |
| The app still answers on another address | Publishing does not close a separate public route the app already has. Bind the app to 127.0.0.1 and stop any tunnel or port forward that points at it. |
| DELETE /v1/qurls/{id} rejects a q_ link ID | That route retires a resource and all its links and does not accept a link ID. To revoke one link, use DELETE /v1/resources/{id}/qurls/{qurl_id}. |
| qurl publish says the local app is not accepting TCP connections | Start the app first and check that curl works on the same address. qurl publish connects to localhost as 127.0.0.1, so if your app listens only on IPv6 (on macOS or Linux, lsof -iTCP -sTCP:LISTEN -nP shows [::1]), publish 'http://[::1]:PORT' instead. Keep the quotes: zsh treats the brackets as a pattern. |
| The recipient sees “Access link invalid” | The link was already used or has expired. Run qurl share again and send the new link. |
| The recipient sees “Resource not found” | The resource was deleted after the link was made. Publish the app again, then run qurl share and send the new link. |
| publish rejects http://127.0.0.1 with “only HTTPS URLs are allowed”, or asks you to log in | You have a CLI older than 3.0. On macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. After updating, qurl --version should print 3.4.1 or later. |
| publish prints no Access: line, or the Access: line says public and you did not ask for public | With no Access: line, the CLI is older than 3.4.1: on macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. A resource that an older CLI published is public unless you published it with --private, and anyone who has the CRID of a public resource can open it. To make a public resource private, run qurl delete <CRID> and publish again with qurl 3.4.1 or later. The new resource is private and has a new CRID. |
| publish says this Linux session “can’t reach a systemd user manager” | You are in a container or sandbox without a user service manager. Run qurl publish with --foreground; sharing lasts as long as that process runs. |
| publish says “Quota Exceeded” with “protected resource limit reached”, or “Your qURL account has reached a plan limit” | You can see this without an account: a device with no account can keep up to 3 active resources, with links that last up to 24 hours. Run qurl list --status active, then qurl delete <CRID> for any you no longer need (it asks you to confirm; --yes skips that). qurl stop keeps the resource, so it does not free a slot. |
Frequently Asked Questions
Can I revoke one link without an account?
No. Revoking a single link is an API call and needs an account. Without one, links end on their own, after one opening or within 24 hours, and qurl stop <CRID> stops serving the app for every link at once.
What is the difference between link expiry and session duration?
Link expiry stops new openings after a deadline; session duration is how long an opened session lasts. Set them with --ttl and --session-duration on qurl share. The session defaults to 1 hour and can run up to 24 hours.
How do I stop sharing?
Run qurl stop <CRID> to pause serving the app, and qurl start <CRID> to resume it; a stopped app still counts toward your resource limit. qurl delete <CRID> removes the resource for good after asking you to confirm; its CRID can never be shared again.
Who else can reach my app while the link is open?
Opening the link admits the network address it was opened from for the session, which lasts 1 hour by default. Other devices that share that public IP address, such as people on the same office or café network or VPN, can reach the app until the session ends. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Keep your app’s own sign-in for anything sensitive.