HubGuides
Access and invitations
Choose who can open an app, or invite someone to just that app.
New apps are accessible to your organization. Use the app's Sharing tab in Cloud Dashboard to change this.
Share a public link
Choose Public, or run:
hub app my-app access publicAnyone with the app URL can now open it without signing in. Changing access requires the admin role or higher.
Invite someone to one app
Keep organization access and invite the person:
hub app my-app invite client@example.comSend them the returned link. Hub does not email it. They sign in with the invited address to open the app.
An invitation covers every instance of this app. It grants no organization membership, Workspace access, or deployment permissions. Members can invite; if any instance is private, only the organization owner can invite.
Revoke access when it is no longer needed:
hub app my-app uninvite client@example.comInvitation links do not expire automatically. Keep them private.
Choose an audience
| Mode | Who can open the app |
|---|---|
| Organization | Organization members and app invitees. |
| Private | The organization owner and app invitees. |
| Public | Anyone, without Hub sign-in. |
Access is set per instance. To add someone to the whole organization, invite a teammate.
Use an app from a script
Open https://api.YOUR-ORG.myhub.host/YOUR-APP, sign in, and choose Create API key. For another instance, append /INSTANCE. If you do not have access, send the owner a request from that page.
Copy the key and save it as HUB_APP_API_KEY in your script’s environment. Send requests to the app’s normal URL:
curl https://my-app.my-team.myhub.host -H "X-Hub-Api-Key: $HUB_APP_API_KEY"Each key works for one app instance and expires after 7, 30, or 90 days. Revoke it on the same page. Removing your app access also prevents the key from working.
The app’s own API endpoints and authentication still apply. Hub leaves its Authorization header available and removes the Hub key before forwarding the request. Keys do not grant deployment or Cloud Dashboard access.
What access does not cover
App access controls visitors, not deployment management. Organization members can still operate a private app. Your app must enforce its own permissions and protect write requests.
Who can put an app in a frame
Only the app itself and your organization's Workspace can frame protected apps. Public apps keep their own framing policy.