Sharing & Transfer

Share a link

Generate a link, send it to someone. They sign in - a free account is enough - and the environment appears in their client. They can look at it, not change it. You can revoke it at any time.

Transfer ownership

Also a link, but accepting it moves the environment to the recipient's account permanently. It requires a paid plan and spare quota on their side. There is no undo.

Export a file

Already covered in the desktop docs - a portable file, not a link, with no ongoing connection to the original once it's been handed over. See the comparison on the sharing overview if you're deciding between the three.

From the environment's menu, generate a share link. You choose how long it lasts - from 1 to 30 days, 7 by default.

The link is shown to you exactly once. There is no page to come back to and copy it again later, so copy it before you close the dialog.

An environment can only be shared with one person at a time. Generating a new link retires whichever one was live before it - if the old link is still open in someone's browser, it stops working.

Opening the link a second time, from the same recipient who already accepted it, does nothing harmful - it is treated as the same acceptance, not a second one. Anyone else who opens it after that gets told it's already spoken for.

Deleting a shared environment does not quietly leave the link alive. The recipient's access ends with the environment, and any managed-proxy access tied to it ends too.

Can

Open the environment and browse with it. Look at its fingerprint. When the owner is on a managed proxy, browse through it without ever seeing its host, username or password - see Your Own Proxy for the exception.

Cannot

Rename it, change its fingerprint settings, delete it, export it to a file, or share it onward to a third person. Those actions stay with the owner.

Shared, not copied

The owner and the recipient are working against one archive, not two that drift apart. Cookies and logins written during the recipient's session are what the owner sees the next time they open it, and the same is true in reverse.

Revoking removes the environment from the recipient's client and stops them from opening it again. If it uses a managed proxy, revoking also cuts off the credential the recipient was browsing through - they lose access to that exit IP along with the environment.

The environment is not left sitting on their machine. When the recipient closes the browser, their local copy is removed as soon as that session has been saved back to your archive - between sessions there is nothing of yours on their disk to take. If the save fails, or if it could not capture everything, the copy is kept rather than discarded - at that point it holds the only complete record of what happened in that session.

A proxy connection that was already open at the moment you revoke can keep running for a short time afterward before it's cut. New connections are no longer issued, but an existing one is not guaranteed to end at the moment you click revoke. Plan around "they can't get back in," not around a precise cutoff time.

The recipient must be on a paid plan with room in their profile quota. A free account cannot accept a transfer.

If the environment is bound to a managed proxy, the recipient also needs room in their proxy quota - the proxy transfers along with the environment, so it now counts against their limit instead of yours.

If the environment instead runs on a proxy you added yourself, its credentials are copied to the recipient's account as part of the transfer - unlike a share link, a transfer does not hold those back.

This is the one operation on this page with no undo. Once the recipient accepts, the environment is gone from your account. There is no revoke, and no path back short of the new owner sharing or transferring it back to you.

Owner-side: current share state for a profile you own - sharedWith (the recipient's email, or null) and any live, unaccepted invite.

Generates a link. Body: { kind: 'SHARE' | 'TRANSFER', ttlDays?: number } - ttlDays clamps to 1-30, default 7. Returns { url, token, expiresAt }. The token is only ever readable in this response - the server stores a hash, not the token itself.

Revokes the current share and any pending invite for the profile, and cuts off proxy access issued because of it. See Revoking above for exactly what this does and does not undo.

Recipient-side: environments shared with you. Each entry carries id, name, config, ownerEmail, hasProxy and updatedAt.

Presigned R2 URLs for the shared archive - GET to download before launch, POST for an upload URL after the session. This is the mechanism behind the one shared archive described above: both sides read and write the same object.

Issues a scoped proxy credential for a shared environment on a managed proxy. Returns { proxyUrl }, or { proxyUrl: null, reason } when there's nothing to hand out - no_proxy (owner isn't using one), owner_custom_proxy (see Your Own Proxy) or unknown_proxy (the environment's proxy settings could not be read - the client refuses to launch on a direct connection rather than guess). A revoked share answers 404.