Secured access

The AgentBox SDK talks to a controller inside every sandbox. Secure access requires a token for commands, filesystem operations, and other controller APIs. It is enabled by default, and the SDK sends the token automatically.

import { Sandbox } from "@abox-dev/sdk";

// Secure access is enabled by default.
const sandbox = await Sandbox.create();

try {
  const result = await sandbox.commands.run("printf secure");
  console.log(`Command result: ${result.stdout}`);
} finally {
  await sandbox.kill();
}

You normally do not need to manage the controller token. If you call the controller API directly, send the X-Access-Token header returned when the sandbox is created.

You can create a sandbox with secure: false in JavaScript or secure=False in Python, but this lets anyone with the sandbox ID call its controller APIs. Do not disable secure access in production.