Previews and standing access

A preview opens one or more hostnames (and optionally TCP services) to named people for a set time. There are two kinds:

• Invites: a single-use link per person, for a review or a demo. Open from 4 hours to 7 days.
• Standing access: a list of addresses or @company.com entries, and one link for everyone. Open for 30 days, 90 days or a year, and extendable.

Opening a preview needs the Create previews permission (Owner, Admin and Member have it). The preview records who opened it; a Member manages only the previews they opened, unless someone grants them more. See Members and roles.

Which hostnames can be in a preview

A hostname can be offered when:

• a connected agent of your workspace forwards it (an exact HG_ALLOW entry, or a name turned on under a wildcard);
• on the hosted service, for the app’s own hostnames, it is under a domain your workspace has verified (any forwarded name can be used as a Houseguest™ address);
• no other open or scheduled preview holds it. A hostname is in one preview at a time.

All hostnames in one preview must share a parent domain, such as lab.example.com for app.lab.example.com and api.lab.example.com. One sign-in then covers all of them. Hostnames under different domains need separate previews.

Open a preview

Previews → New preview is a four-step wizard. Nothing is created until the last step.

1. App & agent: The app’s own hostnames or Houseguest addresses; optionally one agent; tick the hostnames; choose where Viewers land on; a Name (2 to 31 lowercase letters, digits or hyphens; viewers never see it); optionally a Share group.
2. Who can view: Invite or Standing access, and the people. For invites: addresses, one per line, optional (you can invite later). For standing access: addresses or @domain entries. Email code (invites, on by default), Message in the email, and under More options, the settings for cookie-less requests.
3. How long: a length, or Or end at a date (in your browser’s time zone); the viewer session length for standing access; Remind me before it ends; Start later.
4. Review: everything chosen, and how many open previews and emails your workspace has left. Open preview, or Schedule preview.

Standing access → New standing access opens the same wizard with standing access chosen.

Lengths

	Invites	Standing access
Open for	4 hours, 1, 3 or 7 days	30 days, 90 days or 1 year
Extend by	+4 hours, +1 day, +3 days	+1, 7, 30 or 90 days
Longest	7 days from now	1 year from now
A viewer’s sign-in lasts	Until the preview ends	Until the preview ends, 8 hours, or 1, 7, 30 or 90 days

A workspace can lower these limits and choose the default in Workspace settings. Extending past 7 days needs the Extend past 7 days permission.

Schedule a preview

Tick Start later and choose Opens at, up to 90 days ahead. The preview is created at once and holds its hostnames from then, but lets nobody in until the start: viewers see “This preview opens time”. The length counts from the start.

Emails chosen in the wizard, or sent from the preview’s page before the start, wait and go out when it opens. The preview’s page lists who is waiting. Open now starts it early. In the Previews list it appears under Scheduled.

Change an open preview

On the preview’s page:

Tab or button	Does
Copy link	Copies the landing address
Invite / Add people	Invites more people, or adds list entries. See Viewers and sign-in
Extend	Adds time, or Pick a date… for a new end
Hostnames	Add hostname offers names an agent forwards under the preview’s parent domain that no other preview holds. Remove takes one out at once. The landing hostname cannot be removed
TCP & SSH	Add TCP service. See TCP and SSH
Settings	Email code, open paths, cookie-less calls, viewer session length, the reminder, the owner, share groups and who else may manage it
End preview	Closes it for everyone. Type the preview’s name to confirm

Every change applies at once. A preview on Houseguest addresses cannot gain hostnames later: open a new one.

Reminders and notifications

Remind me before it ends emails the preview’s owner once, when the preview turns Closing soon: the last fifth of its life, at least its last hour and at most its last day. A 4-hour preview reminds you with an hour left, a 1-day preview with 4 h 48 min, a week-long one with a day. A preview of an hour or less never turns Closing soon and sends no reminder. Extending re-arms it. Everyone who can see the preview also gets a console notification (the bell) at the same moment.

End a preview

End preview on its page, or tick several in Previews and choose End previews. Every request then answers “This preview has ended”, invites stop working, and the hostnames are free for a new preview at once. Open SSH and TCP connections run until they close.

The Previews list

Tabs Open, Scheduled, Ended and All, filters for owner, access, share group and agent, and a search over names, hostnames and viewer addresses. Export downloads the filtered list as CSV.

Tick previews (only those you may manage have a box) for bulk actions: Extend 7 days, Move to share group, Export viewers (CSV) and End previews. A preview you may not change is skipped and named in the message.

Standing access in the sidebar lists every standing-access preview you can see, with its entries, people and session length. Edit list changes the entries. Recent not-on-list attempts shows addresses that tried to sign in but are not covered by the list, with Add to list.

Apps that make requests without cookies

Some requests never carry the viewer’s sign-in cookie: site icons fetched by the browser, health checks, or API calls made with a bearer token or credentials: "omit". Houseguest cannot tie those to a person, so it refuses them by default. If parts of an app do not load, there are three narrow exceptions, each visible in the request log:

• Site icons pass from the network address a signed-in viewer used in the last 15 minutes. Always on.
• Open without sign-in (More options, or the preview’s Settings): exact paths, written as hostname/path, one per line, such as api.lab.example.com/health. An open path passes for every method, POST and DELETE as well as GET. Use it only for paths that reveal nothing and change nothing.
• Cookie-less calls from a viewer’s network: other cookie-less requests from an address a signed-in viewer used in the last 15 minutes, rate-limited. People behind one office network share an address, so this stays off unless an app needs it.