# LayerV

> LayerV makes private resource access programmable. Keep an HTTP app or API off the public internet, give it a stable cryptographic identity (CRID), and issue a signed access link for each task. LayerV checks authorization before opening the protected origin connection. People open web resources in a browser; agents use a compatible SDK opener. The CLI, SDKs, and API let builders create and withdraw access from code. MCP tools support the URL-based workflow documented in their guide.

## Connector deployment

- [Machine requirements](https://layerv.ai/docs/connector-requirements/): Docker host requirements, tested CPU and RAM allocations, storage, network access, and reproducible measurements.

## Explore LayerV

- [AI-speed attacks](https://layerv.ai/mythos-ready): How private origins and controlled access change automated reconnaissance.
- [Platform](https://layerv.ai/qurl): Publish private resources and share access links.
- [FAQ](https://layerv.ai/faq): Eight categories covering getting started, publishing, sharing, developers, security, deployment, comparisons, and pricing/support.
- [Glossary](https://layerv.ai/glossary): Protocol and access terminology, including publish, share, connectors, CRIDs, and single-use links.
- [Use cases](https://layerv.ai/use-cases): Internal HTTP applications, remote access, and API protection.
- [Comparisons](https://layerv.ai/compare): Cloudflare Access, Zscaler Private Access, Tailscale, and traditional VPNs.
- [Pricing](https://layerv.ai/pricing): Current free-tier offer; contact the team about additional requirements.
- [About](https://layerv.ai/about): LayerV team and background.
- [Standards](https://layerv.ai/standards): LayerV’s role building OpenNHP and its enterprise implementation, with the CSA specification and IETF Internet-Draft as protocol references.
- [Blog](https://layerv.ai/blog): Product updates and security articles.
- [Sign up](https://layerv.ai/qurl/dashboard/keys): Account and API keys.
- [Contact](https://layerv.ai/contact): Deployment and support questions.

## Canonical Hosts

| Environment | API base | Portal links | Headless resolve |
|-------------|----------|--------------|------------------|
| Production | `https://api.layerv.ai` | `https://qurl.link/#at_...` | `POST https://api.layerv.ai/v1/resolve` |

## Create an Access Link Quickstart

The target must be reachable by the service. This API call does not close an existing public route; use local publishing to connect a private origin.

TypeScript:

```ts
const response = await fetch('https://api.layerv.ai/v1/qurls', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.QURL_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    target_url: 'https://app.example.com/dashboard',
    expires_in: '1h',
    session_duration: '1h',
    one_time_use: true,
  }),
});

if (!response.ok) {
  throw new Error(`${response.status}: ${await response.text()}`);
}

const { data } = await response.json();
console.log(data.qurl_link);
```

Python:

```python
import os
import requests

response = requests.post(
    "https://api.layerv.ai/v1/qurls",
    headers={"Authorization": f"Bearer {os.environ['QURL_API_KEY']}"},
    json={
        "target_url": "https://app.example.com/dashboard",
        "expires_in": "1h",
        "session_duration": "1h",
        "one_time_use": True,
    },
)

response.raise_for_status()
data = response.json()["data"]
print(data["qurl_link"])
```

## Gotchas for AI Agents

MCP 0.4.1 `mint_link` accepts legacy resource IDs, not CLI CRIDs. Use the CLI, SDK, or REST API for links to CLI-published resources; the MCP guide shows the supported URL-based `create_qurl` workflow.

A connector reaches the origin over an outbound connection. Keep the origin private and close other public routes. A standard access link is a bearer credential; it is not automatically bound to its intended recipient.

- Use `POST /v1/qurls` to create or find a resource for a `target_url` and receive the first portal link; to issue later portal links for the same resource, use `POST /v1/qurls/{id}/mint_link`, Go `CreatePortal`, TypeScript `createPortal`, Python `create_portal`, or MCP `mint_link` for its supported resource IDs.
- `POST /v1/resources/{id}/share` turns a CRID (or resource ID) the owner holds into a fresh short-lived qURL — the API form of `qurl share <CRID>`. Owner-only; needs the `qurl:resolve` scope.
- Two endpoints mint against an existing resource, and they take different bodies. `POST /v1/qurls/{id}/mint_link` takes `MintLinkRequest` and is the only one that accepts `target_path` (land the recipient on an exact sub-path; qURL Connector resources only). `POST /v1/resources/{id}/qurls` takes `CreateQurlForResourceRequest`, which has no `target_path`. Both accept the resource public key or CRID as `{id}`, so reach for `mint_link` unless you have a reason not to.
- Portal links are returned once and cannot be recovered later. Store `qurl_link` and `qurl_id` when creating or minting.
- Single-use links are consumed once; if headless `POST /v1/resolve` consumes a one-time token and the knock fails, that token cannot be retried.
- `session_duration` controls the post-click access window separately from link expiration. If omitted, the server default is typically `1h`.
- Portal links use the `qurl.link` host in current examples.
- Revoking an individual link can revoke live sessions; follow retry guidance if enforcement returns a retryable failure. Deleting a resource retires the resource and its links.

## Developer references

- [CLI quickstart](https://layerv.ai/start): Install, authenticate, publish a local app, and share a link.
- [CLI reference](https://layerv.ai/cli): Current qURL CLI commands and lifecycle.
- [API index](https://layerv.ai/docs/llms.txt): Integration discovery and examples.
- [Full API reference](https://layerv.ai/docs/qurls.md): RFC 7807 error envelopes, `Retry-After` rate-limit handling, `Idempotency-Key` semantics, access policy fields, and webhook endpoints/events/signatures. Fetch relevant sections rather than the entire reference when context is limited.
- [OpenAPI YAML](https://layerv.ai/docs/qurls.yaml) and [OpenAPI JSON](https://layerv.ai/docs/qurls.json): Generated service contract.
- [Credentials](https://layerv.ai/docs/credentials): Account keys, enrollment tokens, and enrolled device identities.
- [Agent guide](https://layerv.ai/docs/agents): Go SDK enrollment and deployment trust configuration.
- [SDK guide](https://layerv.ai/sdk): Application integration examples.
- [Go SDK](https://github.com/layervai/qurl-go): Agent guide uses `github.com/layervai/qurl-go/qurl@v0.12.0`; configure `QURL_DEPLOYMENT` with the required deployment trust file.
- [TypeScript SDK](https://github.com/layervai/qurl-typescript): Package `@layervai/qurl`.
- [Python SDK](https://github.com/layervai/qurl-python): Package `qurl-python`, import `layerv_qurl`.
- [MCP server](https://www.npmjs.com/package/@layervai/qurl-mcp): `npx @layervai/qurl-mcp`; [tool guide](https://layerv.ai/mcp).

## More information

- [Detailed overview](https://layerv.ai/llms-full.txt)
- General: info@layerv.ai
- Security: security@layerv.ai
- LinkedIn: https://linkedin.com/company/layervai