# Access and invitations

Source: https://docs.myhub.host/access

New apps are accessible to your organization. Use the app's **Sharing** tab in [Cloud Dashboard](https://cloud.myhub.host/dashboard) to change this.

## Share a public link

Choose **Public**, or run:

```sh
hub app my-app access public
```

Anyone with the app URL can now open it without signing in. Changing access requires the admin role or higher.

## Invite someone to one app

Keep organization access and invite the person:

```sh
hub app my-app invite client@example.com
```

Send them the returned link. Hub does not email it. They sign in with the invited address to open the app.

An invitation covers every instance of this app. It grants no organization membership, Workspace access, or deployment permissions. Members can invite; if any instance is private, only the organization owner can invite.

Revoke access when it is no longer needed:

```sh
hub app my-app uninvite client@example.com
```

Invitation links do not expire automatically. Keep them private.

## Choose an audience

| Mode         | Who can open the app                     |
| ------------ | ---------------------------------------- |
| Organization | Organization members and app invitees.   |
| Private      | The organization owner and app invitees. |
| Public       | Anyone, without Hub sign-in.             |

Access is set per instance. To add someone to the whole organization, [invite a teammate](https://docs.myhub.host/teams).

## Use an app from a script

Open `https://api.YOUR-ORG.myhub.host/YOUR-APP`, sign in, and choose **Create API key**. For another instance, append `/INSTANCE`. If you do not have access, send the owner a request from that page.

Copy the key and save it as `HUB_APP_API_KEY` in your script’s environment. Send requests to the app’s normal URL:

```sh
curl https://my-app.my-team.myhub.host -H "X-Hub-Api-Key: $HUB_APP_API_KEY"
```

Each key works for one app instance and expires after 7, 30, or 90 days. Revoke it on the same page. Removing your app access also prevents the key from working.

The app’s own API endpoints and authentication still apply. Hub leaves its `Authorization` header available and removes the Hub key before forwarding the request. Keys do not grant deployment or Cloud Dashboard access.

## What access does not cover

App access controls visitors, not deployment management. Organization members can still operate a private app. Your app must enforce its own permissions and [protect write requests](https://docs.myhub.host/access/identity#protect-your-apps-writes).

## Who can put an app in a frame

Only the app itself and your organization's Workspace can frame protected apps. Public apps keep their own framing policy.

[Read visitor identity](https://docs.myhub.host/access/identity) · [Access command reference](https://docs.myhub.host/cli/app/access)