qURL™
Temporary access
to one private resource.
Keep the app private behind an outbound connector, then share a bearer capability URL for that one resource. You set when it expires and how often it can be used; your app's sign-in still decides who someone is.
Keep the origin private
Run the local app on loopback and connect outward.
No inbound portResource-scoped
A link grants access to one published resource.
One resourceTime-limited
Choose link expiry and supported use limits.
Bounded access
How qURL Works
- LayerV does this
- Your app and LayerV share this
- You deploy this
Hide
You deploy thisKeep a local app on loopback or a private network and run the connector beside it. The connector reaches LayerV outbound; publishing does not close a separate public route your app already has.
Create
LayerVAn authorized owner issues a bearer qURL for one published resource through the CLI, SDK, API, or an agent in Slack or an MCP client. Set a redemption deadline and supported use limits for the task.
Verify
Your app + LayerVThe holder presents the link and LayerV checks the grant and supported access policy. A bearer link alone does not prove the opener’s identity; use your application sign-in when identity must be verified.
Open
LayerVA valid grant opens access to the published resource through the connector. The application still controls which actions its signed-in user or client may perform.
Expire
LayerVThe link stops allowing new redemption after its expiry or use limit. An already-open session has a separate lifetime; revoke a link when the task ends early.
A URL is an address.
A qURL is a temporary access grant.
| Property | URL | qURL |
|---|---|---|
| Default state | Public endpoint stays reachable | Private when the origin stays private |
| Access flow | Reach the endpoint, then authenticate | Check the grant before opening access |
| The address | A public URL or IP anyone can hit | A bearer access link for one resource |
| Reuse | Reusable until it changes | Optional single-use limit |
| Who it’s for | Depends on the app | People and compatible agents |
What a qURL is
- A bearer capability URL for one published resource — whoever holds it can attempt to redeem it.
- Resource-scoped: it permits access to one resource, not the surrounding network.
- Time-limited: a redemption deadline, with single-use and session limits optional.
- Revocable: an owner can revoke an individual link before its normal limits.
What a qURL is not
- Not requester-bound by default: possession alone does not prove the opener's identity. Use application sign-in when identity matters.
- Not action authorization: resource scope is not permission for every operation the application exposes.
- Not a session: link expiry stops new redemption; an already-open session has its own lifetime.
- Not a remote MCP data path: qURL ships local stdio MCP tools and does not document a stock remote Streamable HTTP path.
The link is temporary.
The resource's name is permanent.
Every resource you protect also has a CRID — a permanent name derived from its public key. It is not a secret, but the CRID of a public resource is enough to open it. It never changes when the resource moves, and anyone holding it can verify a delivered key against it with local math — no certificate authority.
3059 3013 0607 2a86 … 544c 09d3 1938983c7f201d25c3e943589af30851b2c15ccf496547050d441aa76f4b7dbfcda2a1260e → base32ae4jqpd7eaoslq7jinmjv4yikgzmcxgpjfsuobiniqnko32lpw743ivbeyha✓ Starts with a — a production name. 60 characters, checksummed, derived in this page.
✓ Structurally valid — production name (the one derived above)
No network involved — every value on this card is derived in your browser and pinned to the public conformance vectors.
Two ways to create a qURL.
The other half
Reaching something private or local?
Keep the local app on loopback or a private network and run a connector beside it. The connector uses an outbound path; it does not close any public route you already expose. Then issue a short-lived qURL for the published resource. The connector carries access outbound; the qURL is the way back in.
Built on OpenNHP.
Every qURL carries a full Network Hiding Protocol exchange — network hiding without protocol code to write. NHP is backed by the Cloud Security Alliance and IETF, and open source.