bead application URLs - bead

Use bead application URLs to reach each machine application port through an HTTPS hostname:

https://<port>-<machine-id>.bead.run

The machine detail supplies the deployment domain. The edge enforces access to this hostname; knowing the hostname does not grant application access.

Open the URL locally

bead open ID --port 3000

The CLI creates an authenticated localhost tunnel and opens your browser. To keep browser launch separate:

bead port-forward ID --port 3000 --local-port 3000

The tunnel supports HTTP and WebSockets and retains your application’s own authentication. It does not put a bead token in the URL.

Choose the right access method

Access method	Purpose
Authenticated application hostname	Access a machine service through the edge
Local CLI tunnel	Open that service in your own browser
Worktree preview link	Share an expiring preview for a worktree service
Desktop watch link	Give view-only access to the desktop
Raw TCP or UDP port	Reach a transport endpoint with a source-network ACL

Possession-based preview and desktop links carry their own grants. Keep those links private and revoke them when the handoff ends. App templates can become machine-ready before their HTTP application finishes initializing. Retry the authenticated application connection while it starts. See template selection.