Spinneryspin share signed-links --service web --service api --expires-in 2hCreates a named signed dev link for the workspace and prints the one-time URL, host, selected services, and expiration.
Docs / Signed dev links
Signed dev links create scoped browser sessions.
Spinnery signed dev links are app handoffs, not tunnels. Use spin share [workspace] to create, list, or revoke the signed URL that names the service, workspace, organization, route family, and expiration before the gateway creates a browser session for dev.spinnery.dev traffic.
signed dev linkbrowser session
$spin share signed-links --service web --service api --expires-in 2h
service: web
workspace: signed-links
org: acme
host: web--signed-links--acme.dev.spinnery.dev
session: web, /api, assets, websockets; expires 2h
wake: verified dev request can start sleeping runtime
blocked: ssh, secrets, logs, runtime admin
CLI workflow
spin share is the first-release sharing command.
The share command is the product workflow for reviewer links. It creates scoped signed dev links, lists existing links for handoff review, and revokes links without exposing token material.
spin share signed-links --listShows existing signed links, status, allowed services, hosts, paths, expiration, and safe session counts without printing token hashes.
spin share signed-links --revoke link_123Disables an existing signed dev link at the gateway without deleting the workspace, shell, runtime state, or logs.
--jsonReturns bounded JSON for agents and scripts while omitting secret token material from list and revoke output.
Session lifecycle
The gateway checks the signed scope before any runtime traffic.
The host shape keeps links readable, but the signed session is the permission boundary. Runtime wake, route readiness, and request forwarding happen only after the signed dev link scope is verified.
lifecyclegateway enforced
- Issue
spin shareThe CLI creates the signed link.
Run spin share for the workspace, choose the allowed services, and set an expiration before the reviewer gets the one-time signed dev URL.
- Open
dev.spinnery.dev/share/tokenThe gateway verifies scope before wake or forwarding.
The first request checks the signature, creates a workspace-scoped browser session, wakes a sleeping runtime when needed, and only then forwards app traffic to the selected service.
- Use
web + /api + assets + websocketsThe same session covers the product surface.
Browser routes, same-origin API calls, static assets, and realtime paths reuse the signed dev session so reviews behave like the real app.
- Close
expire or revoke at gatewayRemoving the session does not delete the workspace.
Expired or revoked links stop at the gateway while shell access, repo state, runtime sleep, and workspace metadata remain governed separately.
Boundary
Signed dev link access stops at the app surface.
A signed dev link can wake the runtime for review traffic, but it does not become workspace administration. Operational access remains behind Auth0 roles, CLI access, Tailscale policy, and root policy.
web / /api / assets / websockets- Browser routes for the selected service
- Same-origin /api calls bound to the workspace
- Static assets served by the selected service
- WebSocket and realtime paths declared for the app
ssh / secrets / logs / admin- SSH and raw shell access
- Secret values and environment stores
- Logs, traces, and private consoles
- Mailpit, MinIO, databases, and runtime admin
scope + readiness + expiration- Share the signed dev link, not a raw runtime host, port, VM name, or IP address.
- Name the service, workspace, organization, and expiration in the handoff so reviewers know the scope.
- Confirm web, /api, assets, and realtime routes are ready or clearly marked as waking.
- Revoke or let the link expire when review ends; do not rely on DNS changes for access removal.