Private apps
Keep an app private to your team and reach it with hart curl.
Your workspace's addresses are private unless you choose otherwise: only signed-in members of your team can open them. This guide shows what that means for browsers and scripts, and how to keep a custom domain private too.
Who can open what
| Address | Private by default? | Make it public | Make it private |
|---|---|---|---|
| Dev URL and public ports | yes | create the workspace with Visibility Public | keep Private |
| Custom domain | no | leave Team members only off | turn Team members only on |
On a private address, a browser that is not signed in is sent to the console's sign-in, and comes back after it. A signed-in user without access to the team is refused.
Call a private address from a script
Send an API key of a team member in the Harthelm-Authorization header:
curl -H "Harthelm-Authorization: Bearer $HART_TOKEN" https://123-3000.apps.example.com/api/healthHarthelm checks the key and removes the header before the request reaches your app, so the key never shows up in your app's logs. Create a key under Account settings → API keys.
hart curl
hart curl does the same with the key of your hart context. Give it a path of the current
workspace's dev URL:
hart curl -w 123 /api/healthOr a full URL of one of your team's verified custom domains:
hart curl -i https://shop.example.com/adminIt refuses every other URL before sending anything, so your key goes nowhere else. Common flags work as in curl:
-X, -H, -d (@file reads a file, @- stdin), -i, -I, -L, --fail and --max-time. --port picks a
public port of the workspace instead of the dev URL.
Not from inside a workspace
Inside a workspace, hart curl to a dev URL does not work: workspaces do not reach the installation's public edge. Call
your services directly there, for example http://localhost:3000 in the IDE's terminal for a server you started
yourself.
Keep a custom domain private
Turn on Team members only when you add the domain, or later under Routing → Access and limits:
hart domain set shop.example.com --restrictedVisitors then sign in to Harthelm first and need access to the team, or send a team member's API key.
Revoke access
Deleting or regenerating an API key stops it at once, also on workspace addresses. Removing someone from the team ends their access to the team's private addresses.