Sharing & visibility

Every deployed app has a public URL, but you decide who can actually open it. Sharing works like a document: four modes, changeable at any time.

The four modes

  • Public: anyone with the URL can open it.
  • Link: private until you generate an unguessable secure link; only someone with that link gets in. You can rotate the link (killing the old one) or attach an expiry.
  • Org: anyone in the owning organization can open it after signing in.
  • Private: operator only; no link grants access.

New apps default to link mode (private until you share), so nothing is exposed by accident.

Set it from anywhere

From the CLI:

jollop share my-app                 # print the secure link (minted once; running it again returns the same link)
jollop share my-app --rotate        # revoke the current link and issue a new one
jollop share my-app --public
jollop share my-app --private
jollop share my-app --expire 168h   # link expires in 7 days

From the app’s Share panel, or by asking the agent (“make my-app public”).

How org visibility stays safe

Deployed apps run your (untrusted) code on their own subdomain, so the platform deliberately never exposes your session there. For an org-visibility app, an uncredentialed request is bounced to an authorizer on the main control-plane host (where your session legitimately lives). It checks that you belong to the app’s organization and hands back a narrow, app-scoped capability, then sends you to the app. The app subdomain only ever sees that per-app capability, never your session or the operator token.