Sharing & Permissions

Visibility

Every app is either private or public.

Private (default) — only you can see the app.

Public — anyone can view the app, even without an account.

Changing visibility

From the editor — click the lock icon in the editor toolbar to toggle between private and public.

From your dashboard — click the menu (⋮) on any app card and select Make public or Make private.

Publishing to a live URL

Publishing creates a permanent public URL at cdbx.ai/username/app-name where anyone can open and interact with your app in a standalone page.

Team apps use the team's handle, not a person's name. An app that belongs to a Team workspace is published at cdbx.ai/your-team-handle/app-name (and your-team-handle.cdbx.ai) no matter which member clicked Publish. Change the handle in Team → Settings and the links move with it. A published app can't be moved between your personal account and a team — unpublish it first, because the link would change.

Publishing is only available for frontend apps (React, Vue, Svelte, HTML). Apps that are purely backend (Python, Go, etc.) cannot be published this way.

To publish, click Publish in the editor header. After publishing, the URL appears with a copy button and an option to open it in a new tab.

Clicking Unpublish removes the live page — visitors will see a 404 until you publish again.

Free plan — a small CDBX badge appears in the bottom corner of published apps.

Pro plan — the badge is hidden.

Preview links

Every app also has a preview link — a private URL you can share before publishing, or instead of publishing at all. Preview links open a real cdbx page (not a bare iframe): the owner's name, the app's name, a star count, and an "App Preview" label so it's clear this isn't the published version.

Anyone with the link can Fork the app from that page — signed in, it copies straight into their account; signed out, it prompts them to sign in first.

In a team, a preview link only opens for people the app is shared with, unless the app has been made public. That includes the live preview of a running app: opening its address without access takes you to cdbx to sign in or ask for access.

If you're viewing your own preview, the page also shows quick links back to your editor and dashboard. If your app has a server that isn't currently running, visitors see a friendly "This app is asleep" message instead of an error — the page updates on its own once you open the app again.

Sharing from the dashboard

Open the (⋮) menu on any app card and select Share. This shows the published URL and an iframe embed snippet you can paste into a blog post or docs page:

<iframe src="cdbx.ai/username/slug" width="100%" height="600" />

The Share option only displays a URL if the app has been published.

Share button in the editor

When an app is published, a Share button appears in the editor header next to the Publish button. It shows the same URL and iframe embed snippet as the dashboard Share panel.

What a card tells you

Each app, deck and doc card in Apps and Files shows:

• Who can see it: Only you, Specific people, Team can view, Team can edit or Public. Hover it for the full sentence, e.g. "Everyone in Acme can view it, plus 2 people by name".
• Who made it: "by" and their name, or "by you" on your own.
• Views: how many times other people have opened it. Each person counts once a day, and your own opens never count.
• When it was last updated.

Slide decks and docs show their first slide or page on the card.

Someone who can only view something gets its reading page when they open it: the slides (with Present), the document, or the app's preview. Only people who can edit get the editor.

In a team, the filter at the top of Apps and Files has Owner: Mine, Shared with me (things shared with you by name) and Whole team (everything else in the team you can see). Cards you can only view have just an Open button; anything you can edit has the full controls.

Pinning apps

Pin up to 6 apps to feature them at the top of your public profile.

Open the (⋮) menu on any app card and select Pin to profile or Unpin. Pinned apps show a pin badge and float to the top of your dashboard. On your public profile (cdbx.ai/username), pinned apps appear in a dedicated "Pinned" section above all others.

Forking

Fork any public app to create an independent copy under your own account. The original is recorded as the fork source, but changes to either copy do not affect the other.

To fork, open the (⋮) menu on any app and select Fork.

Starring

Star apps to bookmark them or show appreciation for someone else's work. Click the ★ icon on any app card to star or unstar it.

Team sharing

To move one of your own apps into your team, open Settings → Sharing & Access → Who can open this and pick your team under Belongs to. This works on any plan as long as your team has a paid plan. Once the app is in the team it follows the team's plan, so its Private switch, collaborators and custom domain unlock too. An app that arrives in a team starts private and is taken off the public internet — share it again from there.

Three levels

Everything in a team — apps, slide decks, docs — can be shared at one of three levels:

• View only — open it and read it. For a slide deck that means reading and presenting; for an app, using the published app.
• Can edit — everything above, plus change it.
• Admin — everything above, plus delete it and change who it is shared with.

The person who made something is its Admin.

Who gets what

In Settings → Sharing & Access → Who can open this:

• Belongs to — Just me, or your team. Moving something into the team doesn't share it with anyone; it starts with no team access.
• Team access — what everyone in your team can do: No access, Can view or Can edit. New things start with No access unless your team's admin has chosen otherwise.
• Specific people — add a teammate or a guest and give them their own level. Use this to make one person an Admin, or to share a private item with just a few people.

Two things to know:

• Your team's owner and admins can always open and manage everything in the team, including items you keep Private.
• Viewers and guests are free, so they can only ever be View only. To let one of them edit, an owner or admin changes their team role to Builder, which adds a paid seat.

Changing the owner

An Admin of an app, deck or doc can give it to someone else on the team: Settings → Sharing & Access → Who can open this → Owner. The new owner must be a Builder, an Admin or the team's owner. If you give away something private, you'll no longer see it unless its new owner shares it with you. Services you had connected to it don't come across — the new owner sets up their own.

Asking for access

If you follow a link to something in your team that hasn't been shared with you, you'll see You don't have access to this. Add a note if you like and press Ask for access. The people who manage it are notified and by email; you get a notification and an email when they answer. If you can already view something and need to change it, the same page offers Ask to edit.

If someone asks for access to something of yours, the notification takes you to their request. Choose View only, Can edit or Admin and press Approve, or Decline. Waiting requests also show under Access requests at the top of the item's Who can open this settings.

Only people in your team can ask. Someone outside it just sees a page that doesn't exist.

Sharing outside your team

Things in a team are not reachable from the public internet unless someone makes them public. Publishing a team app does not make it public — it is published to the people it is shared with.

• To show one thing to someone outside your team, an owner or admin adds them as a guest (Team → Members → Guests), and then you add that guest under Specific people on the item. A guest signs in and sees only what they were added to.
• To make something open to anyone with the link, switch it to Public. Your team's owner and admins can always do this; other members can only if the team allows it (Team → Settings → Sharing).

Someone who follows a link to a team item while signed out is asked to sign in and is then taken straight to it. A team item that is not public only opens at its cdbx.ai address, not on a custom domain.

See Team Workspaces for roles, guests and the team's sharing settings.

Domain-gated login (Team)

For internal company apps, you can restrict sign-in to people with an email address at your own domain — for example, only @yourcompany.com accounts can get in.

This is available on server-backed apps on the Team plan and above. Open Settings → Sharing & Access → Domain-gated login, turn it on, and enter your domain — or leave the domain field empty to use your workspace's own default domain, if an owner or admin has set one.

Turning it on does two things:

• It tells the AI to write a Google sign-in screen into your app that only accepts your domain.
• It adds three placeholder rows to Settings → Environment Variables: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and ALLOWED_EMAIL_DOMAIN (already filled in with the domain you entered).

You provide the Google OAuth client yourself — register one in your own Google Cloud Console (restricted to your Google Workspace) and paste its client ID and secret into those two empty rows. cdbx never sees or brokers the login; it's entirely your app talking to your own Google client. The domain check happens on your server from Google's verified response, not from a value a visitor's browser could fake.

Deployment protection (Team & Enterprise)

Restrict who can reach a published app with a real server — useful for an internal tool you don't want the whole internet to be able to open, even by guessing the URL.

Open Settings → Sharing & Access → Deployment protection. Two independent controls, and you can use either or both:

• IP allowlist — add one or more IP ranges (e.g. your office network or VPN egress range, written as a CIDR like 203.0.113.0/24). Only visitors connecting from one of those ranges can reach the app.
• Require sign-in — visitors must be signed in to cdbx to view the app.

A blocked visitor sees the same "not found" page as an app that doesn't exist — it never gives away that a restricted app is there.

This covers your app's default cdbx URL and any custom domain you've attached. The IP allowlist also applies to the live preview address of a running app. Require sign-in does not apply there yet.

Discover

Every published, public app appears at cdbx.ai/explore (opens in a new tab) — a community gallery anyone can browse without an account. Cards link straight to the live published page, and a preview of recent work also appears on the cdbx.ai landing page.

To keep something out of Discover, make it private or unpublish it — only published + public items are listed.