> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ns.rocks/llms.txt
> Use this file to discover all available pages before exploring further.

# Networking And Security

> Expose, secure, and connect to services running inside machines.

Networking docs cover how machine processes receive inbound traffic, how
clients connect to streaming endpoints, how tokens protect access, and when to
use SSH instead of HTTP preview routing.

## Choose A Connection Path

| Need                                                           | Use                                                                 |
| -------------------------------------------------------------- | ------------------------------------------------------------------- |
| Open an HTTP service running inside a machine                  | [Preview URLs](./preview-urls)                                      |
| Expose a machine service behind your own domain or app session | [Custom Preview Proxy](./custom-preview-proxy)                      |
| Connect to a WebSocket server in the machine                   | [WebSockets](./websockets) or a signed preview WebSocket URL        |
| Connect local developer tools over OpenSSH                     | [SSH access](../access/ssh)                                         |
| Restrict outbound traffic or understand bearer tokens          | [Access control](./access-control) and [Token model](./token-model) |

## Preview URL Shape

```python theme={"theme":{"light":"one-light","dark":"one-dark-pro"}}
from nullspace import Machine

with Machine.create(template="base", timeout=300) as machine:
    server = machine.commands.run(
        "python3 -m http.server 8080 --bind 0.0.0.0",
        shell=True,
        cwd="/workspace",
        background=True,
    )
    try:
        print(machine.get_url(8080))
    finally:
        server.kill()
```

The service inside the machine must bind to `0.0.0.0`, not only `127.0.0.1`.
Preview URLs are signed bearer URLs; treat them like temporary credentials.

## Security Model

| Surface                      | Security Note                                                              |
| ---------------------------- | -------------------------------------------------------------------------- |
| API keys                     | Control-plane credentials for SDK, CLI, and API calls.                     |
| Preview URLs                 | Signed grants for a specific machine port.                                 |
| Custom preview proxy targets | Header-token targets intended for customer-run reverse proxies.            |
| Traffic access tokens        | Optional private-traffic bearer tokens enforced by machine network policy. |
| SSH                          | Certificate-backed relay access, separate from preview URL routing.        |

## Networking Guides

<CardGroup cols={2}>
  <Card title="Preview URLs" href="./preview-urls">
    Expose HTTP and WebSocket services running inside a machine.
  </Card>

  <Card title="Custom Preview Proxy" href="./custom-preview-proxy">
    Front machine previews with your own reverse proxy.
  </Card>

  <Card title="Access control" href="./access-control">
    Restrict outbound network access for machine workloads.
  </Card>

  <Card title="Token model" href="./token-model">
    Separate API keys, preview tokens, proxy tokens, traffic tokens, and signed URLs.
  </Card>

  <Card title="WebSockets" href="./websockets">
    Connect to streaming machine endpoints.
  </Card>

  <Card title="SSH" href="../access/ssh">
    Connect to a machine over SSH when the workflow requires it.
  </Card>
</CardGroup>

## Related

* [API keys](../guides/api-keys)
* [Share a preview URL](../guides/share-machine-url)
* [Proxy tunneling](../guides/proxy-tunneling)
* [Commands](../commands/overview)