qURL™
Identity-bound access
to a hidden resource.
A connector takes your resource off the network. The qURL is the way back in — expiring on its own, and as tight as one use for one person.
Invisible first
A connector beside your app takes it off the network.
Can't find itIdentity-bound
Reachable only with cryptographic proof.
Can't share itSelf-destructing
Single-use, and it expires on its own.
Can't reuse it
How qURL Works
- LayerV does this
- Shared with your IdP
- You bring this
Hide
You deploy thisA connector runs beside your resource and it stops answering the internet: no standing exposure, no version to fingerprint. For an HTTP app that keeps a public URL, proxy mode fronts it via DNS instead.
Create
LayerVOne API call — or one message to an agent in Slack, Discord, or an MCP client — mints a qURL for that hidden resource, and sets who it’s for and when it expires.
Verify
Your IdP + LayerVThe person or agent you approved opens it. Identity is proved first — people through the IdP you already run (Okta, Microsoft Entra ID), agents through the resolve API. LayerV brokers the check; your IdP stays the source of truth.
Open
LayerVA passing check triggers the network knock, and the connector opens one connection for that session, to that resource. Nothing else becomes reachable.
Expire
LayerVIt closes on its own and the link is spent — the resource goes back to invisible. Nothing to rotate, no standing credential left behind.
A URL is an address.
A qURL is a verified, one-time key.
| Property | URL | qURL |
|---|---|---|
| Default state | Always visible | Invisible until verified |
| Access flow | Connect, then authenticate | Verify, then connect |
| The address | A public URL or IP anyone can hit | A cryptographic, one-time token |
| Reuse | Reusable until it changes | Single-use — spent on first open |
| Who it’s for | Human, browser-driven | People and agents alike |
The link is temporary.
The resource's name is permanent.
Every resource you protect also has a CRID — a permanent name derived from its public key. It grants nothing, never changes when the resource moves, and anyone holding it can verify a delivered key against it with local math — no certificate authority.
3059 3013 0607 2a86 … 544c 09d3 1938983c7f201d25c3e943589af30851b2c15ccf496547050d441aa76f4b7dbfcda2a1260e → base32ae4jqpd7eaoslq7jinmjv4yikgzmcxgpjfsuobiniqnko32lpw743ivbeyha✓ Starts with a — a production name. 60 characters, checksummed, derived in this page.
✓ Structurally valid — production name (the one derived above)
No network involved — every value on this card is derived in your browser and pinned to the public conformance vectors.
Two ways to create a qURL.
The other half
Reaching something private or local?
Run a lightweight connector beside it — Docker, Kubernetes, ECS — and it comes off the network. Then mint links the same way. The connector makes it unreachable; the qURL lets you back in.
Built on OpenNHP.
Every qURL carries a full Network Hiding Protocol exchange — network hiding without protocol code to write. NHP is backed by the Cloud Security Alliance and IETF, and open source.