# Public endpoints

Expose a port inside a sandbox at a private HTTPS URL. Requests reach the VM through HareBox's edge, which checks access, then tunnels into the VM through the guest agent, so nothing in the VM needs a public address. Every HTTP method, streaming responses and WebSockets pass through. HareBox removes its own token and cookie before a request reaches your app.

> **Status:** served for real to local VMs, and checked by HareBox's real-VM tests. Public DNS and TLS for `*.on.harebox.com` need a deployment.

```sh
harebox new --name web
harebox host current 3000 --title App
harebox host list current
```

| Access | Who can open it |
|---|---|
| `token` (default) | Anyone with the full URL. Treat it as a password |
| `public` | Anyone |
| `oidc`, `mtls` | Fails closed until a provider is connected. Planned |

## Rotate a token

Rotation is atomic. The old and new tokens both work during the overlap, and the URL is never open without one.

```sh
harebox new --name rot
EP=$(harebox host current 3000 | jq -r .id)
harebox host rotate current "$EP" --overlap-seconds 60
```

## Wake on request

An incoming request wakes a sleeping sandbox, and its dev server is still running. The first request after sleep sees added latency. Turn this off with `wake_on_request: false`.

## Custom domains

```sh
harebox domain add --name preview.example.com
```

The response lists the DNS records to create. In this local build, DNS and TLS aren't connected, so a domain stays `pending_dns`.