FeaturesAccess and network
A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
Every provider gives you an HTTPS address for a port inside the machine. What differs is the lock. A provider-key link needs an API key or a signed token on every request. A token-in-the-URL link is a password you can paste: convenient, and exactly as safe as the place you pasted it. An open link has no lock at all.
The open case is more common than buyers expect. boxd's name.boxd.sh is public to the internet with no authentication in front of it. InstaBox's public ports are unauthenticated by design, though a port can instead be made private behind a token. Agent 37's public port is deliberately credential-free and keeps working until you delete it. In each case the URL is the only secret.
The other doors are less visible. SSH is sometimes a real port, sometimes a WebSocket tunnel, sometimes a shell over the provider's own transport. Raw TCP exists at a few providers and is missing at most. The provider's API is always a door, and sometimes the only one.
The claim on the left, the provider's own words on the right
Sandboxer puts a token in the preview URL by default and strips it before the request reaches your app. Lizard uses one token per sandbox, so a link to one port opens every exposed port on that machine. Sprites makes the URL private to the organisation, reachable with an org token.
At boxd and InstaBox the URL is the only credential. Agent 37 goes further and sells an explicitly public port that anyone can reach with no credential at all.
Runtime, boxd and Boat support a raw TCP path; Boat's depends on IPv4, which is not guaranteed. Sandboxer and InstaBox route SSH through a gateway. Lizard has no SSH protocol at all: its ssh command is an interactive shell over the provider's transport, so scp, rsync and port forwarding do not work.
Vercel exposes web ports and bills traffic to them, but a general raw TCP inbound or a personal SSH endpoint is not published.
A URL that wakes a machine is a different product from a URL that returns an error. Sprites, Runtime and InstaBox document wake on request. boxd's bot protection gates the wake: a webhook, API client or uptime monitor gets a 503 check page and the machine does not wake.
Boat cannot wake on a URL at all, because a stop removed the machine.
The same job at every provider, from the documented defaults
The agent builds a demo on port 3000. You copy the HTTPS address and paste it into a shared channel for a client, who opens it the next morning from a different country.
You copy the URL. Whether it carries a token, and whether that token covers one port or the whole machine, is already decided.
The machine goes idle or stops. The link either wakes it, returns an error, or points at a machine that no longer exists.
The client opens the link. Anyone with the URL, or only someone holding a key, gets through.
Four providers here put no authentication in front of the port at all, and one makes the token per machine rather than per port. A URL that wakes a sleeping machine is a different product from one that returns an error.
The details that decide the answer in practice
Who can open the link: only you, anyone you send it to, or anyone who guesses it.
Whether the token is per port or per machine.
Whether a request to a sleeping machine wakes it or returns an error.
Whether raw TCP and SSH exist, and whether SSH is a real port or a tunnel.
Whether the URL survives a stop and resume.
Docs read 28 October 2026
| Provider | Who can open the link | Does it? | What that means |
|---|---|---|---|
| Agent 37 | API key, or public | Yes | Every port gets an HTTPS URL; instance and preview URLs require an API key or a time-boxed signed URL. A public port is deliberately unauthenticated and permanent. SSH is tunnelled; no raw TCP.Agent 37 docs: Instance and preview URLs — HTTPS per port, signed URLs ↗Agent 37's own wordsdocs-confirmed“Instance URLs require auth on every request” |
| Blaxel | Optional auth | Partly | Specific ports can be exposed, and preview URLs back a running sandbox with optional auth and custom domains. Default ingress authentication is not published.Blaxel docs: Real-time previews ↗Blaxel's own wordsdocs-confirmed“Render an application in real-time through a direct preview URL backed by a running Blaxel sandbox, with optional auth and custom domains.” |
| Boat | Token by default | Partly | An HTTPS route per port, token-gated by default and --public to remove it; SSH on port 22; raw TCP by opening the sandbox firewall, but only IPv6 is guaranteed.Boat docs: Public URLs ↗Boat's own wordsdocs-confirmed“boat does not support custom domains.” |
| boxd | No auth | Yes | Every machine is on name.boxd.sh with no authentication in front of it; subdomain proxies add ports, up to three raw TCP forwards, and SSH on a dedicated port. Bot protection only gates wake-ups.boxd docs: HTTPS ↗boxd's own wordsdocs-confirmed“When a request would wake a sleeping machine, boxd first asks the visitor to pass a quick browser check.” |
| Cloudflare Sandbox | No public port | Partly | HTTP from the internet reaches the instance only through your Worker. No built-in preview auth, token or IP allowlist. SSH exists only through Wrangler, does not start a stopped container and does not keep one alive.Cloudflare Sandbox docs: Preview a web application ↗Cloudflare Sandbox's own wordsdocs-confirmed“The server has no public port, so your Worker forwards requests to it.” |
| Daytona | Token, or signed URL | Partly | Preview links are authenticated unless public is true. The standard token is sandbox-wide, opens the terminal and toolbox, and cannot be revoked; signed URLs are per port, 60 seconds by default and 24 hours maximum.Daytona docs: Preview (preview URLs and tokens) ↗Daytona's own wordsdocs-confirmed“If a sandbox has its public property set to true, preview links are publicly accessible without authentication. Otherwise, authentication is required.” |
| E2B | No auth | Partly | Public URLs are reachable by anyone who knows them, with no authentication by default. SSH runs through a WebSocket proxy rather than a native port.E2B docs: Sandbox public URL ↗E2B's own wordsdocs-confirmed“By default, a sandbox's public URLs are reachable by anyone who knows them.” |
| InstaBox | Public or token-only links | Partly | An HTTPS link per port, up to 16, either public or private behind a replaceable token. SSH and mosh go through a gateway. Raw non-web ports are in an admin-only preview, later paid plans only with 5 per workspace. No custom domain.InstaBox docs: Public and private ports — HTTPS URL per port ↗InstaBox's own wordsdocs-confirmed“A private port answers only requests that carry its token.” |
| Lizard | One token per sandbox | Partly | A preview URL per exposed port, gated by one token per sandbox that opens every port on it. WebSockets pass through. No raw TCP, no SSH protocol, no custom domains for sandboxes.Lizard docs: Preview URLs — HTTPS per port with an access token ↗Lizard's own wordsdocs-confirmed“The token belongs to the sandbox, not to a port: it opens every port you expose on that sandbox” |
| Modal | Connect token | Yes | No inbound by default. Expose encrypted, h2 or unencrypted ports; connect tokens are the recommended path for HTTP and WebSockets, and raw TCP is possible. inbound_cidr_allowlist is not enforced on unencrypted tunnels.Modal docs: Sandbox networking: forwarding ports and tunnels ↗Modal's own wordsdocs-confirmed“You can make authenticated HTTP and WebSocket requests to a Sandbox by generating Sandbox Connect Tokens.” |
| Morph | Not published | Partly | An instance can expose an HTTP service through the API. Default authentication and raw TCP support are not published.Morph docs: HTTP Services ↗Morph's own wordsdocs-confirmed“Expose Http Service” |
| Runtime | Closed until opened | Yes | Nothing is reachable until you open a door: token-gated previews, custom domains, raw TCP ports, a WireGuard or Tailscale private network, or SSH over the API.Runtime docs: Private preview links ↗Runtime's own wordsdocs-confirmed“Nothing on the internet can connect in to a sandbox. These are the ways in. You open each one yourself” |
| Sandboxer | Token in URL | Yes | A stable HTTPS address per port, private by default with a token in the URL; --public removes it. A public IPv6 with the firewall closed except SSH. No raw-TCP endpoint.Sandboxer docs: Hosting ↗Sandboxer's own wordsdocs-confirmed“Private (default) | https://…-3000.box.sandboxer.com?_token=… | Anyone with the full URL.” |
| Sprites | Org token | Partly | Every Sprite has an HTTPS URL that is private to the organisation by default, reachable with an org token. SSH requires installing a server and proxying it.Sprites docs: Networking ↗Sprites's own wordsdocs-confirmed“A Sprite URL is private by default. It's reachable only by members of your org, through the browser or with an org token” |
| Vercel Sandbox | Web ports only | Partly | Web ports can be exposed, up to 15 per sandbox, and traffic to them is billable. The dashboard's Connect tab gives a terminal in the browser. A general raw TCP inbound, standard SSH or public IPv4 is not published.Vercel Sandbox docs: Sandbox concepts: network access and exposed ports ↗Vercel Sandbox's own wordspricing-page“Data your sandbox sends to the internet, plus all traffic to and from exposed ports, is billable and measured in GB.” |
| Tensorlake | HTTPS per portauth on by default | Yes | The proxy carries HTTP, WebSocket and gRPC, and preserves path and query. Auth is the default: requests need a project API key, or a signed-in session cookie from a browser. allow_unauthenticated_access makes exposed user ports public, but the management API on port 9501 always requires auth.Tensorlake docs: Networking — sandbox public URLs, exposed ports and auth ↗Tensorlake's own wordsdocs-confirmed“https://<port>-<sandbox-id-or-name>.sandbox.tensorlake.ai routes to a user service listening on <port> inside the sandbox” |
Each one checked for every provider, with the catch where a version falls short. All capabilities
YesWith a catchNoNot publishedHover or select a mark to see the catch.
Each one targets something the documentation does not answer
Answered from the capability checks; each links to the provider-by-provider detail and its sources
Part of Access and network. Next: put two or three providers side by side.