Skip to content

Sharing and passwords

Share a preview safely

Your preview link and your connection key do different jobs. The link is for people who should see your app. The connection key is a secret that only your cloud environment should receive.

Okay to share

Preview link

This is the https://p-…firstdraft.io address you open in a browser. Its random name is hard to guess, but anyone who receives it can open the app unless you turn on password protection.

Keep secret

Connection key

This begins with AGENT_VM_TUNNEL=. It lets a cloud environment connect an app to your preview. Paste it only into the matching Codex or Claude environment.

Require a password to open your preview

In First Draft, open Previews → Preview settings, then find Password protection. Turn it on, choose a browser username and password, and save.

  1. Send the preview link to the people who should see the app.
  2. Send the browser username and password through a separate trusted message when practical.
  3. Change or turn off password protection from the same preview page.

Password protection controls who can open the app in a browser. It does not replace the connection key, and it does not make development data suitable for production use.

Protect development data too

  • Do not enter real customer data, production credentials, or long-lived secrets into a preview app.
  • Never commit the connection key to the repository, a dotenv file, an issue, or a chat transcript.
  • Deleting a preview disables its old link and connection key.