Skip to main content
Secure access authenticates communication between SDK and sandbox controller. Sandbox controller runs in sandbox itself and exposes APIs for work with file system, run commands, and generally control the sandbox via our SDK. Without secure access, anyone with a sandbox ID can access the controller APIs and control the sandbox from inside.
SDKs version v2.0.0 and above are using secure access by default when creating sandbox. This may not be compatible with older custom templates and you may need to rebuild them.

​
Migration path

When using custom templates created before envd v0.2.0, you need to rebuild the templates to enable secure access. SDK versions 2.51.0 and above ignore the secure option and always create sandboxes with secure access through Sandbox.create. To create sandboxes from these templates with these SDK versions, rebuild them first. You can check the template envd version using the e2b template list command or by viewing the templates list on the dashboard.

​
Supported versions

All sandboxes based on templates with envd version at least v0.2.0 already support secure access without any additional changes. The secure access flag was introduced in 1.5.0 for JavaScript and Python SDKs to be used optionally. Starting with SDK version v2.0.0, sandboxes are created with secure access enabled by default.

​
Access sandbox API directly

In some cases, you might want to access sandbox controller APIs directly through its URL, such as when you are not using SDKs. When secure access is enabled, you must provide an authentication token that was returned during sandbox creation. Each call to the sandbox controller must include an additional header X-Access-Token with the access token value returned during sandbox creation. For sandbox upload and download URLs, you need to generate pre-signed URLs. We are advising to use SDK for generating presigned URLs.

​
Deprecated secure option

The secure option is deprecated. SDK versions 2.51.0 and above accept it for backward compatibility but ignore it. With these SDK versions, passing secure: false does not disable secure access, and every sandbox created with Sandbox.create has secure access enabled.