preview-cmd
v0.5.2
Published
Temporary, audience-aware preview links for anything you can tunnel.
Readme
preview-cmd
Temporary, audience-aware preview links for anything you can tunnel.
$ preview create --port 3000
https://q7m3xk.preview-my.app/#t=v1.eyJsIjoibG5rXy...
run on the machine serving port 3000:
cloudflared tunnel run --token eyJhIjoi...
expires 2026-11-08T14:02:11.000Z
revoke preview revoke lnk_...One link, one disposable hostname, one expiry, one revoke call. Built on Cloudflare Tunnel and a Worker gate, so guest viewers need no preview-my-app account or seat by default.
Paid plans add preview stacks, client review, confidential watermarks, visual review, live request logs, custom domains and enterprise identity through OIDC, SAML or Cloudflare Access.
Install
npm install -g preview-cmd
preview versionRequires Node.js 20 or newer.
Start
$ preview signup --anonymous
ok tenant tn_... — unverified
one 6-hour link; verify your email to unlock ten 8-hour links and 1 GB/month
$ preview create --port 3000 --ttl 24h
$ preview list
$ preview renew lnk_...
$ preview revoke lnk_...Anonymous signup needs no email and is rate-limited. Verify later with
preview verify --email to unlock ten 8-hour links, five invites per link and
1 GB/month. Credentials are stored in
~/.config/preview-my-app/credentials.json with mode 0600. Already have a
key? Run preview login --key ....
For a quick look without an account, preview demo --port 3000 starts a
throwaway TryCloudflare tunnel (no gate, expiry or review controls).
Agent
Run the connector as a service on the machine serving your app:
$ preview agent enroll --token enr_...
$ preview agent install # launchd, Task Scheduler or systemd --user
$ preview agent statusLinks created against an agent share one Cloudflare tunnel, so previews are cheap to keep running.
Preview stacks
Group a web app, API and worker under one invite, expiry, review decision and revoke:
$ preview stack create --name acme-pr-123 \
--service web:3000 --service api:8080
$ preview stack invite stk_... --email [email protected] --opens 1
$ preview stack review stk_... --approveEvery service keeps its own hostname; one PIN or SSO sign-in covers the
stack. preview stack show lists the services, preview stack invites lists
recipients, and preview stack revoke removes every service together.
Sharing controls
Links are disposable by default and can be tightened before sending:
$ preview create --port 3000 --ttl 2h --pin 2468
$ preview invite lnk_... --name Sarah --email [email protected] --opens 1
$ preview renew lnk_... --ttl 24h
$ preview revoke lnk_... # or revoke-invite / revoke-all--pin stores only an HMAC. Per-recipient invites can require an email code
and cap opens. preview views and preview stats show who opened a link, and
preview scan checks a build for leaked credentials before it is shared.
Client review
Add --review to a link or stack to show a review toolbar in the preview.
Viewers can pin comments to an element, approve, or request changes; owners and
agents can read the decision from the CLI:
$ preview review lnk_...
$ preview review lnk_... --approve --comment "ship it"
$ preview stack review stk_... --changes --comment "fix the header"Review events can be delivered to a webhook, and preview mcp serve lets an
agent wait for the decision instead of polling.
Confidential previews
Paid links and stacks can add edge-enforced confidentiality:
$ preview create --port 3000 --confidential --one-time --max-concurrent 1 \
--countries US,CA --allow-ip 203.0.113.0/24
$ preview stack create --name "Board review" --service web:3000 \
--watermark --block-print --one-time--confidential adds a per-viewer watermark and print deterrence;
--watermark, --block-print, --countries, --allow-ip, --one-time and
--max-concurrent control the individual policies. One-time claims and
concurrent caps are atomic in a Durable Object per link or stack. The watermark
uses the SSO or invite email when available.
Visual review
Capture the current preview into the review gallery:
$ preview screenshot lnk_...
$ preview stack screenshot stk_... --service webDesktop (1440×900) and mobile (390×844) screenshots are rendered with Cloudflare Browser Rendering, stored in R2 and shown on the stack review page (newest four). A short-lived capture token bypasses the viewer exchange without consuming invites or one-time claims.
Live request logs
Watch requests while a client clicks through:
$ preview logs lnk_... --limit 50
$ preview logs lnk_... --follow --interval 1s
$ preview stack logs stk_...Each entry has time, status, latency, response bytes, country, IP, method, path
and user agent. Query strings, bodies and cookies are never stored. --follow
streams new rows; preview stack logs merges the stack page and every service.
The last 200 requests are kept per link or stack.
Enterprise SSO
Pro and Team can require the tenant's own identity provider before a viewer gets a preview session. Viewers sign in with their existing company account; preview-my.app creates no accounts and no seats.
$ preview auth oidc set --issuer https://acme.okta.com --client-id 0oa123 --client-secret-stdin --domains acme.com
$ preview auth oidc test
$ preview auth saml set --entry-point https://acme.okta.com/app/.../sso/saml --certificate-file okta.crt --idp-issuer http://www.okta.com/exk123 --domains acme.com
$ preview auth saml metadata
$ preview create --port 3000 --sso
$ preview stack create --name "Acme review" --service web:3000 --service api:8080 --sso
$ preview sso lnk_... --sso-protocol oidc # toggle an existing link
$ preview stack sso stk_... --off # toggle a whole stackOIDC client secrets are encrypted at rest. SAML assertions and responses are
verified against the configured certificate. --sso-protocol oidc|saml picks a
provider when both are configured, and --pin can be combined with SSO.
Saving or removing a provider invalidates existing SSO sessions. Successful
sign-ins emit an sso.login webhook. For SAML, use the IdP's signing
certificate, not its encryption certificate.
Cloudflare Access
Paid tenants that already run Cloudflare Access can reuse it instead of configuring OIDC or SAML:
$ preview auth access set --team acme.cloudflareaccess.com \
--aud <application-aud-tag> --domains acme.com
$ preview create --port 3000 --access
$ preview auth access show
$ preview auth access removeThe edge verifies Cf-Access-Jwt-Assertion against the team JWKS, issuer and
audience, then enforces the email-domain allowlist. --access and --sso are
mutually exclusive, and one-time confidential links cannot use Access. The
preview hostname must sit behind the tenant's Access application, so attach a
customer-hosted custom domain first.
Custom domains
Paid plans can attach a customer hostname to a link:
$ preview domain lnk_... preview.acme.com
$ preview domains lnk_...The CLI prints the CNAME target and the gateway provisions the certificate.
Custom domains replace either shared domain, while free links stay on
preview-my.work.
Automation
preview mcp serve --stdio exposes preview creation, listing, invites and the
review loop over MCP. The HTTP API at https://preview-my.app does the same for
CI and agents, and the GitHub Action wraps the CLI to publish a link per pull
request.
Plans
Unverified free accounts get one 6-hour link; verifying email unlocks ten
8-hour links, five invites per link and 1 GB/month. Free and anonymous links
are served from preview-my.work; paid links default to preview-my.app and
can choose either with --domain. Pro starts with a 14-day free trial; the
card is collected up front.
$ preview upgrade pro
14 days free, then $19.00/mo
checkout: https://checkout.stripe.com/...For an agent-driven 30-day pass, use a Stripe shared payment token:
$ preview upgrade pro --spt <shared_payment_token>
ok pro active until 2026-12-07T... (payment pi_...)Commands
preview create --port <port> [--agent <id>] [--ttl 8h|24h|7d|<seconds>] [--label <name>] [--review] [--domain app|work] [--pin <pin>] [--sso] [--sso-protocol oidc|saml] [--access] [--confidential | --watermark] [--block-print] [--countries US,CA] [--allow-ip <cidr>] [--one-time] [--max-concurrent <n>] [--connect | --no-connect]
preview stack create --name <name> --service web:3000 --service api:8080 [--ttl 8h] [--review] [--domain app|work] [--pin <pin>] [--sso] [--access] [--confidential] [--one-time]
preview stack list | show <stackId> | revoke <stackId>
preview stack sso <stackId> [--sso-protocol oidc|saml] [--off]
preview stack invite <stackId> [--name <name>] [--email <email>] [--opens <n>]
preview stack invites <stackId> | revoke-invite <inviteId>
preview stack review <stackId> [--approve | --changes] [--comment <text>]
preview stack screenshot <stackId> [--service <name>]
preview stack logs <stackId> [--follow] [--interval 1s] [--limit 100]
preview screenshot <linkId>
preview logs <linkId> [--follow] [--interval 1s] [--limit 100]
preview domain <linkId> <hostname> | domains <linkId>
preview scan [path] [--json]
preview list
preview stats [linkId] [--days 7]
preview invite <linkId> --name <name> [--email <email>] [--opens <n>]
preview invites <linkId>
preview review <linkId> [--approve | --changes] [--comment <text>]
preview sso <linkId> [--sso-protocol oidc|saml] [--off]
preview views <linkId>
preview token <linkId>
preview renew <linkId> [--ttl 8h|24h|7d|<seconds>]
preview revoke <linkId>
preview revoke-invite <inviteId>
preview revoke-all
preview demo --port <port>
preview agent enroll --token <token> [--name <name>]
preview agent install | uninstall | run | status | logs | rotate | revoke <id>
preview agents | agent create --name <name>
preview auth oidc set | show | test | remove
preview auth saml set | show | metadata | remove
preview auth access set | show | remove
preview login | logout | signup
preview billing status | portal | quote <plan> | upgrade <plan> [--spt <token> | --wait]
preview mcp serve --stdioLicense
AGPL-3.0-or-later. See LICENSE. The hosted service and its configuration are
not part of the open-source release.
