Restrict public access

Public URLs accept requests without authentication by default. Set allowPublicTraffic in JavaScript or allow_public_traffic in Python to false when you create a sandbox to require its traffic access token.

import { Sandbox } from "@abox-dev/sdk";

const sandbox = await Sandbox.create({
  network: { allowPublicTraffic: false },
});

try {
  await sandbox.commands.run("python3 -m http.server 8080", {
    background: true,
  });
  await sandbox.commands.run(
    "until curl -fsS http://127.0.0.1:8080/ >/dev/null; do sleep 0.1; done",
  );

  const url = `https://${sandbox.getHost(8080)}`;
  const anonymousResponse = await fetch(url);
  console.log(`Without token: ${anonymousResponse.status}`);

  const authorizedResponse = await fetch(url, {
    headers: {
      "Agentbox-Traffic-Access-Token": sandbox.trafficAccessToken,
    },
  });
  console.log(`With token: ${authorizedResponse.status}`);
} finally {
  await sandbox.kill();
}

A request without the token receives 403. Send the token in the Agentbox-Traffic-Access-Token header. Read it from sandbox.trafficAccessToken or sandbox.traffic_access_token; do not print or store it in application logs.

This setting protects incoming requests to every public URL of the sandbox. It does not disable outbound internet access or SDK commands. Configure outbound connections separately in Internet access.