---
title: Environment Access
url: "/docs/apps/environment-access/"
canonical_url: https://docs.blossom88.com/docs/apps/environment-access/
markdown_url: https://docs.blossom88.com/docs/apps/environment-access.md
summary: Choose who can open an Environment's URLs, share it with a link, and let
  tests through with a token
---

# Environment Access

Each Environment has one access mode for all of its URLs, including custom
domains and [static sites](/docs/build/static/). Set it under
**Settings → Access**. Changes apply within about 30 seconds.

| Mode | Who can open it |
|---|---|
| **Public** | Anyone with the URL. |
| **Account members** | People signed in to Blossom who can view the Environment. Anyone else is asked to sign in. |
| **Password** | Anyone with a shared username and password (basic auth). |

From the CLI:

    blossom environment:update --id ENVIRONMENT_ID -d '{"environment":{"access_mode":"members"}}'

Members stay signed in for 12 hours. Changing the mode signs everyone out.
**Sign everyone out**, under Advanced, ends every session at once; someone who
leaves the Account or loses access to the Environment is signed out within
about 30 seconds. Account members needs HTTPS, so it can't be used while an
HTTP-only domain is attached.

## Maintenance Page

Show a maintenance page while you work, then reopen traffic when ready:

    blossom environment:maintenance:enable --id ENVIRONMENT_ID --follow
    blossom environment:maintenance:show --id ENVIRONMENT_ID
    blossom environment:maintenance:disable --id ENVIRONMENT_ID --follow

Maintenance changes public routing only. Services, jobs and database connections
keep running. Scale Services separately when you need them stopped. The same
control is available under Environment **Settings → Maintenance**.

## Previews

Previews use **Account members** by default, whatever their Environment uses.
To give them the Environment's own mode instead, choose **Same as** the
Environment's name, such as **Same as production**, for **Access** in
Preview Settings. The setting covers all of the Environment's Previews at
once: a change there, including a new password, reaches every Preview within
about 30 seconds.

A Preview's Access tab shows what it inherits: the mode, password users,
public paths and bypass tokens, each with where to change it. Its shareable
links are its own. A Preview's pull request comment says who can open it, and
never includes a link, token or password.

## Shareable Links

A shareable link lets someone without a Blossom login, such as a client,
open an Account members Environment. It opens only the Environment or
Preview it was made on. Links expire after
1, 7 (the default) or 30 days, or never.

    blossom environment:access:link:create --environment ENVIRONMENT_ID --expires 30
    blossom environment:access:link:show --id LINK_ID
    blossom environment:access:link:revoke --id LINK_ID

**Copy link** on the Access tab, or `link:show`, gives a fresh URL for the
same link. Revoking a link stops it within about 30 seconds.

## Bypass Tokens

A bypass token lets automated tests, uptime monitors and screenshot tools
through Account members. Send it as the `X-Blossom-Access` header:

    blossom environment:access:token:create --environment ENVIRONMENT_ID --name CI
    curl -H "X-Blossom-Access: $BLOSSOM_ACCESS_TOKEN" https://shop.example.com/

The token is shown once; store it as a secret in the tool that sends it. The
Access tab shows only its last four characters, such as `bxa_****k3f9`, so
you can match a token to its row. Tokens don't expire unless you choose 30,
90 or 365 days; revoke one with `environment:access:token:revoke`.

## Public Paths

Webhooks from Stripe, GitHub or an OAuth provider can't sign in. List the
paths that skip the sign-in under **Advanced → Public paths**, one per line;
end a path with `*` to include everything under it:

    blossom environment:update --id ENVIRONMENT_ID -d '{"environment":{"access_public_paths":["/webhooks/*"]}}'

Clear the list to turn them off. Public paths apply to the Environment's
Previews too. A request path containing `\` or `;` never counts as public.

Links and tokens are named for you, such as `quiet-river`; hover a name on
the Access tab to rename it.