Dory is in development. The invite-only beta has not opened yet; prices and limits are planned and may change.
Doryby ComputeEngines
Request beta access

Previews, share links and hooks

A preview exposes one guest port through a private HTTPS origin. A hook accepts a bounded incoming webhook; it is not a general website. Use the returned URL and its credential type; do not invent a public port or treat a preview credential as an API key.

Creation, redemption and revocation

Method Path Purpose
GET /computers/{id}/previews List
POST /computers/{id}/previews {port, expires_in ≤ 2592000} returns {id, port, url, access_url, access_url_expires_at, expires_at}; access_url holds a one-time token
POST /computers/{id}/previews/{prv_id}/access-links New one-time access_url; its mandatory expires_at is the redemption deadline, not the preview's expiry
POST /computers/{id}/previews/{prv_id}/tokens {expires_in ≤ 2592000} returns {token: "cpt_..."} for the CE-Preview-Token header
DELETE /computers/{id}/previews/{prv_id} Revoke the preview, its links and tokens (within 15 seconds)
POST /computers/{id}/previews/{prv_id}/links Share link. Tier 1: expires_in ≤ 86400, max_uses ≤ 10. Tier 2: expires_in ≤ 604800. Opens through an interstitial page with a report-abuse link. At most 5 active per account (Tier 1), 25 (Tier 2)
DELETE /computers/{id}/previews/{prv_id}/links/{lnk_id} Revoke, including previously redeemed browser grants (within 15 seconds)
GET, POST /computers/{id}/hooks {port, path_prefix:"/", methods:["POST"]} returns {id, url}; Tier 1: 10 per account, Tier 2: 50
POST /computers/{id}/hooks/{hok_id}/rotate New token; the old URL stops working at once
DELETE /computers/{id}/hooks/{hok_id} Revoke

Tier 0 has no previews, share links or hooks (403 tier_limit). Tier 1 and Tier 2 live caps are 20 and 100 previews, 100 and 500 combined live links and credentials, and 10 and 50 hooks. The combined count includes access and share origins (even exhausted links), program tokens and browser grants; exceeding a cap returns 403. GET /limits names the counters previews_active, preview_credentials_live, share_links_active and the hook count. A downgrade limits new issuance, not authority already issued.

The default duration of a preview, program token or share link is 86,400 seconds, capped by the parent credential and tier. Both tiers default a share link's max_uses to 10; each link permits 10 redemptions a minute and 100 live browser grants. Exhausted links do not count against the separate 5 / 25 active-share quota, but do count towards the combined live total while their grants are live. Access links and program tokens are capped by the deadline of the credential that issued them; hooks and share links belong to the account and outlive the key that created them. Program tokens are revoked per preview. A small set of guest ports is reserved; using one returns 422.

Redeeming an access link needs a same-origin POST; a GET or HEAD never consumes it. A hook path_prefix is a canonical absolute prefix matched on whole path segments; encoded forms, dot segments, backslashes and semicolon parameters are refused rather than normalized. Invalid or non-matching incoming paths return 404; the query string is forwarded unchanged. The hook URL contains its token plus the path prefix.

Each redeemed access or share link creates a browser grant bound to its preview and originating link. The cookie is __Host-ce_preview (Secure, HttpOnly, no Domain). The grant expires at the earliest of 24 hours after redemption, the preview's expiry and the originating link's expiry. A one-time access link expires at the earlier of 10 minutes after it is issued and the preview's expiry. A share-link use is one successful redemption into a browser grant, after the interstitial page; page assets and reloads using that cookie do not use up further uses. Redemption answers with a 303 to the preview's clean URL. When uses run out, new redemptions stop, but grants already issued stay valid until you revoke the link or they expire. Preview credentials are valid for the exact preview and port only. Revocation closes active streams within 15 seconds.

  • Previews send X-Robots-Tag: noindex on every response; client X-CE-* headers are stripped; Set-Cookie headers with a Domain attribute are removed from responses. Your application cannot set or overwrite __Host-ce_preview.
  • Token-bearing URLs are shown once. A hook's full url is returned only by create and rotate, and a share link's full url only by create. Lists and other reads show url_prefix plus a masked token (token_masked), because we store only a hash of the token.
  • Hooks are for webhooks into always-running agents (GitHub, Slack, Telegram). They accept only the listed methods (never GET or HEAD), requests up to 1 MB, responses up to 64 KB with Content-Type forced to application/json or text/plain, and 10 requests per second per hook. A hook to a computer that is not running returns 503 with Retry-After. They cannot serve web pages.

Tenant cookies

Do not trust cookies set for the parent preview domain in your app. Public previews are not available.

Dory is in development; these pages describe the planned service and may change. Questions: support@computeengines.com.