Secure Sharing

Secure shares are expiring proxy capabilities. They let another person call an API through your Proxies.ai proxy without receiving the API credential stored in its vault.

Create a share

1. Open a running Fly proxy in the dashboard and select Secure Shares.
2. Choose a lifetime from five minutes to thirty days.
3. Set the maximum accepted request count.
4. Select a vault. The share can only reach hosts bound to that vault.
5. Create the share and copy its proxy URL.

Use the proxy URL

HTTPS_PROXY='https://share:<capability>@proxy-host:<port>' \
  curl https://api.openai.com/v1/models

The URL is a bearer capability. Send it through a secure channel and never place it in source code, issue trackers, shell history, or logs.

Enforcement

• Fly terminates TLS before forwarding traffic to the per-share gateway.
• The sidecar stores only a SHA-256 hash of the capability token.
• Each accepted HTTP request or CONNECT tunnel atomically consumes one use.
• Denied vault hosts do not consume a use.
• The dedicated listener closes immediately after the final use and within one minute of expiry.
• Traffic is chained to local Squid, so firewall rules, blocklists, access logging, and ICAP credential injection still apply.

Revoke early

Revoke an active share from the dashboard or run cifp share remove <share-id>. Proxies.ai removes the Fly service mapping and closes the listener.

Provider support

Direct shares currently require Fly-managed TLS termination. Proxies.ai rejects direct share creation on providers that do not have an authenticated TLS ingress instead of exposing capability credentials over plaintext.