Preview and share tokens
Preview tokens
A preview token (prefix mp_*) is a short-lived signed token that authorizes a browser to load a sandbox preview without receiving the workspace API key.
The typical flow:
- Your backend calls
POST /api/v1/sandboxes/{id}/preview-tokenwith the sandbox ID and a TTL (max 24 hours). - MIOSA returns an iframe-ready URL with the token embedded.
- The browser loads that URL, for example
https://<slug>.sandbox.miosa.ai?mt=mp_.... - MIOSA’s edge verifies the token server-side and proxies the request to the sandbox port. The token value never grants broader access.
Preview tokens are non-renewable and non-transferable. When the TTL expires the URL returns 401. Your backend mints a new token to restore access.
curl -X POST https://api.miosa.ai/api/v1/sandboxes/$SBX/previews/$PREVIEW/share
-H "Authorization: Bearer $MIOSA_API_KEY"
-d '{"ttl_seconds": 3600}'Share tokens
A share token (prefix ms_*) is a revocable public share URL for a sandbox preview - analogous to a “share link” in a document editor.
Key differences from preview tokens:
Preview token (mp_*) | Share token (ms_*) | |
|---|---|---|
| Intended recipient | Your authenticated user | Anyone with the link |
| Minted by | Your backend | Your backend |
| Revocable | Yes (delete the token) | Yes (delete the token) |
| Password protection | No | Optional |
| Expiry | Required TTL | Optional |
Share tokens are useful for demos, client reviews, or collaborative previews where the recipient does not have a user account in your system. The link can be embedded as a plain URL - no Authorization header needed.
Next
- Tenant configuration: preview domains and error-page branding.
- Browser Tokens reference: minting, scopes, and revocation.
- Core Concepts: the one-screen overview.