# Platform > How LayerV gives people and software controlled access to private apps through the connector, access links, dashboard, API, and webhooks. Source: https://layerv.ai/platform/ --- LayerV Platform # Your app stays private. Access comes through LayerV. LayerV gives people and software controlled access to an HTTP app or API without a direct public route to the app itself. ![](https://layerv.ai/images/room/access-room.webp) - Scanners Probe for open ports - Bots Attempt automated access - Attackers Try common entry points - Generic tools Scan for vulnerabilities - No public route The app has no address to find - Access issued After your sign-in For a limited time - Your application Internal app or API Only via the connector Public internet: open and untrusted Your private environment: not exposed Hide ## The Enterprise connector takes the app off the internet. One container, or the qurl binary, runs beside the application and opens a single outbound connection to LayerV. It proves its identity with an authenticated packet first, and LayerV answers nothing until that proof arrives. Nothing on your side listens, so a scanner gets no reply, no banner, no certificate. There is no inbound rule to open and no public DNS record to find. [The Enterprise connector →](https://layerv.ai/platform/connector/) [See the access diagram →](https://layerv.ai/platform/#how-it-works) - Outbound only: one authenticated UDP packet, then one TCP tunnel out - Pinned image, read-only root, non-root user, your own state volume - Enrolls once with a one-shot token; the credential stays in your state directory - Keys sealed to the TPM, or held by AWS KMS, GCP KMS, Nitro, or Confidential Space - Generated deploys for Docker, Compose, ECS/Fargate, and Kubernetes - An existing public hostname or load-balancer route stays open until you close it Access ## Your own sign-in decides who gets a way in. The app keeps its own authentication. Your identity provider or backend issues the link after its own checks, and the link is the way back in once you close any existing public route. [Every access control →](https://layerv.ai/security/access-controls/) [Issue links from your code →](https://layerv.ai/sdk/) - Single-use, or up to 1,000 concurrent sessions per link - IP allowlists of up to 100 addresses or ranges - Issued from your backend with the SDKs or the REST API - Revoked from the dashboard or the API, ending live sessions The life of one link Two separate limits: an opening deadline from 1 minute to 30 days, and a session length from 1 second to 24 hours once the link is opened. Revoking the link ends its live sessions. [See every access control →](https://layerv.ai/security/access-controls/) Control ## See what is active, and send every event to your own systems. Everything the dashboard shows, the API and SDKs can read and change, and signed webhooks carry access events to wherever you keep records. [Open the dashboard →](https://layerv.ai/login/) [API reference →](https://layerv.ai/docs/) - Dashboard: resources, links, active sessions, usage, API keys, devices, domains - OpenAPI reference and three SDKs for the same endpoints - HMAC-signed webhooks for access, denial, revocation, and quota events - Scoped API keys and one-shot enrollment tokens; nothing durable in config files - Custom domains for the links your people receive Where people and agents use it ## One access layer, six ways to reach it. - [Enterprise connector Runs beside the app in your own environment and connects out to LayerV. Requirements, sizing, and the deployment steps.](https://layerv.ai/platform/connector/) - [CLI Publish from a terminal; the connector is built in. Share an app running on your machine in minutes.](https://layerv.ai/cli/) - [qURL Desktop Share from a Mac without a terminal.](https://layerv.ai/desktop/) - [SDKs and API Go, Python, TypeScript, REST.](https://layerv.ai/sdk/) - [MCP server Agents mint their own links in Claude, Cursor, and Codex.](https://layerv.ai/mcp/) - [Slack People ask for a link in the channel they already use.](https://layerv.ai/slack/) The boundary ## Your app stays yours. LayerV only handles access. LayerV checks access grants, carries approved traffic, and runs the API. Your app and its data stay in your environment, and your identity provider keeps control of sign-in. LayerV processes traffic in transit as described below. You operate and control - Your application and its data - Your users’ identities, which stay with your provider - App authentication, sessions, and permission checks - The connector’s keys, its state, and your network - Your code, your repositories, your infrastructure - The decision to issue a link, and to take it back What LayerV handles Request That a valid one arrived, and from which address Link events Issued, opened, denied, revoked, and when Session Source IP, user agent, first and last seen Usage Against your plan Unencrypted qURL traffic at TLS termination points is processed transiently to route it; relayed content is not retained. ## Built on a standard. Run as a service. The protocol is OpenNHP, published by the Cloud Security Alliance and on the IETF track, with LayerV as co-author. The platform is how you use it without building it. [Pilot LayerV](https://layerv.ai/platform/#contact-sales) [Quickstart](https://layerv.ai/start/) [The OpenNHP standard](https://layerv.ai/standards/) ![](https://layerv.ai/images/room/access-room-close.webp) Access issued Time-limited Your application Private network --- *This markdown version is auto-generated from [https://layerv.ai/platform/](https://layerv.ai/platform/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*