Private links between apps. Previews only the right people open.
Let one app reach another at <app>.internal with no public door. Put an app behind a password, a share link for a client, or tokens signed by your organization. Cap its bandwidth and its new outbound connections.
ry network link api --from web
Network and protection, in detail.
Private links
ry network link api --from web lets web reach api at api.internal over the private network. No public port needed. Internal addresses resolve inside the region only.
A password
ry protect password asks for it interactively, never as an argument, or generates one and prints it once.
A share link per client
One address the customer opens, labelled with who it is for, with an optional expiry. Revoke it and it stops working within about two seconds.
Signed access
With ry protect signed, only visitors with a token signed by your organization get in; everybody else sees "no app with that name". Partners can sign with their own Ed25519 keys.
Sign everybody out
ry protect rotate signs every visitor out immediately; the password and the links stay valid.
Bandwidth and connection caps
A network policy caps an app's bandwidth in both directions and its new outbound connections per minute.
Link, protect, share.
From the CLI or the API. A preview from a branch is protected by a link already.
ry network link api --from web # web reaches api at api.internal ry network list ry protect password web # asked, never an argument ry protect link web --label "client Smith" --expires 30d ry protect revoke web lnk_1a2b3c4d # stops within ~2 seconds ry protect signed web ry protect token web --ttl 30m --sub user-42
curl -X POST https://api.rytiv.com/v1/apps/web/link \
-H "Authorization: Bearer $RYTIV_TOKEN" \
-H "Content-Type: application/json" \
-d '{"target": "api"}'
# 201 with app, target, name, activeInS
curl -X POST https://api.rytiv.com/v1/apps/web/protection/links \
-H "Authorization: Bearer $RYTIV_TOKEN" \
-H "Content-Type: application/json" \
-d '{"label": "client Smith"}'
# 201 with the url to hand out The bounds, as the platform enforces them.
Limits
- Private address
- <app>.internal, inside the region only
- Database address
- <db>.internal, only in attached apps
- Share link label
- 1 to 64 characters
- Access token
- 1 second to 1 day, default 60 s
- Signed visitor cookie
- 60 s to 1 day
- Links per job
- up to 8 linked apps
Every bound is on Limits and quotas. A request outside them answers 400 with bad-request and names the field.
Errors you will meet
| 409 | not-protectedRotate, a share link or an access token on an app that is public |
| 403 | agent-token-production-readonlyA production agent token may only read |
| 404 | not-foundNot found, or not yours |
Every error is JSON with a sentence and a stable code. Branch on code. See the error catalog.
Private links and protection carry no price of their own. Outbound data transfer is included at no charge, fair use applies.
For businesses and freelancers. All prices excluding VAT. Prepaid credit in euros, no plans, no seats. Introductory pricing until 31 January 2027. Pricing
What developers ask about Network and protection.
Answers from the documentation. The Protection and network API has the rest.
Who can reach api.internal?
The apps you linked to it with ry network link. Internal addresses resolve inside the region only. A database's <db>.internal resolves only inside apps attached to it.
Password, share link or signed?
A password for a small team. A share link per client or reviewer, revocable on its own. Signed when your own product decides who gets in and mints tokens for them.
Are previews protected?
Yes. A preview from a branch is an app of its own, protected by a link.
How do I make an app public again?
ry protect off web. The CLI asks first; pass --yes in scripts.
Can I restrict where an app connects to?
The app network policy caps bandwidth and new connections per minute. An allowlist of domains and IPv4 ranges is available on sandboxes and through the egress field of a deploy.
What do webhooks cover?
The mail events: sent, delayed, bounced, complained, failed and received. See Mail.
On the same API, the same bill.
Link two apps.
Deploy two apps, link them in one line.
claude mcp add --transport http rytiv https://api.rytiv.com/v1/mcp --header "Authorization: Bearer <your key>"
For businesses and freelancers, from a solo developer to a team. Pricing