Sharing and passwords
Share a preview safely
Your preview link and your connection key do different jobs. The link is for people who should see your app. The connection key is a secret that only your cloud environment should receive.
Okay to share
Preview link
This is the https://p-…firstdraft.io address you open in a browser. Its random name is hard to guess, but anyone who receives it can open the app unless you turn on password protection.
Keep secret
Connection key
This begins with AGENT_VM_TUNNEL=. It lets a cloud environment connect an app to your preview. Paste it only into the matching Codex or Claude environment.
Require a password to open your preview
In First Draft, open Previews → Preview settings, then find Password protection. Turn it on, choose a browser username and password, and save.
- Send the preview link to the people who should see the app.
- Send the browser username and password through a separate trusted message when practical.
- Change or turn off password protection from the same preview page.
Password protection controls who can open the app in a browser. It does not replace the connection key, and it does not make development data suitable for production use.
Protect development data too
- Do not enter real customer data, production credentials, or long-lived secrets into a preview app.
- Never commit the connection key to the repository, a dotenv file, an issue, or a chat transcript.
- Deleting a preview disables its old link and connection key.