Public URLs

Public URLs (Beta) lets you share a service running on this device with an HTTPS link. It is an optional, separate Zync SaaS feature. It is not SSH port forwarding and does not replace SSH tunnels.

Sharing creates internet exposure

Anyone with an active Public URL can reach the shared service unless you protect the share with the optional password. Share only a service you intend to expose.

How it works

1. Sign in to the Public URLs account from Zync with GitHub or Google.
2. Create a share for a selected localhost port, such as 127.0.0.1:3000.
3. Optionally set a share password.
4. Zync’s desktop share agent connects to the Zync relay and shows the generated HTTPS URL.
5. Send the URL to people who need access to that local service.

The desktop agent accepts loopback targets only: localhost, 127.0.0.1, or ::1. It carries HTTP and WebSocket traffic from the selected service through the public HTTPS or WSS endpoint while the share is active.

Separate from SSH and Drive Sync

Public URLs is not an SSH tunnel. It is not equivalent to ssh -L, ssh -R, or ssh -D, and it does not require an SSH session to stay connected.

Feature	Public URLs	SSH port forwarding
Target	A service listening on this device’s loopback interface	A connection reached through an SSH server and session
Access	HTTPS link through the Zync relay	Local, remote, or SOCKS endpoint configured in SSH
Account	Separate Public URLs share account	No Public URLs account required
Lifetime	While the share agent is running and the share is active	Usually tied to the SSH tunnel process

The Public URLs account and OAuth clients are separate from Google Drive Sync. Signing into Public URLs does not grant access to drive.appdata, and Drive Sync sign-in does not create a share account.

Share lifetime

An active share remains available while the desktop share agent is running on this device. Disconnecting an SSH session does not stop it.

To end access, stop or delete the share in Zync. Signing out also ends the local share agent session. If you only close the service on the selected port, the share may remain active and return connection errors until you stop it.

Safer sharing

• Use the optional share password for anything that is not intended to be openly reachable.
• Avoid sharing admin panels, local control services, or ports containing private data.
• Treat the URL like a bearer capability. Anyone who obtains it may try to connect while it is active.
• Stop or delete the share as soon as the sharing task is complete.
• Keep the desktop agent and Zync release up to date.

Public URLs Beta uses a hard quota cap rather than subscription tiers in the app. Stop unused shares before creating more. To unlink the account completely, sign out in Zync and revoke the Zync application from the connected GitHub or Google account.

The share agent stores its session tokens in the operating-system credential store. Zync does not automatically send SSH sessions, vault secrets, or terminal content to the Public URLs service. The relay carries traffic for the loopback port you selected while the share is active.

Troubleshooting

The share cannot connect

Confirm that the local service is listening on the selected port and that it is reachable through localhost, 127.0.0.1, or ::1. Non-loopback targets are refused by design.

The link stopped working

Check that the share is still active and that the desktop share agent is running. Restart the share if the agent lost its relay connection.

I expected an SSH tunnel

Use Port Forwarding for local, remote, or SOCKS SSH forwarding. Use Public URLs only when you want a public HTTPS link to a loopback service.

Related docs

• Security for exposure and credential boundaries.
• Sync & Backup for the separate Google Drive feature.