Environment Access

Each Environment has one access mode for all of its URLs, including custom domains and static sites. Set it under Settings → Access. Changes apply within about 30 seconds.

From the CLI:

blossom environment:update --id ENVIRONMENT_ID -d '{"environment":{"access_mode":"members"}}'

Members stay signed in for 12 hours. Changing the mode signs everyone out. Sign everyone out, under Advanced, ends every session at once; someone who leaves the Account or loses access to the Environment is signed out within about 30 seconds. Account members needs HTTPS, so it can’t be used while an HTTP-only domain is attached.

Maintenance Page

Show a maintenance page while you work, then reopen traffic when ready:

blossom environment:maintenance:enable --id ENVIRONMENT_ID --follow
blossom environment:maintenance:show --id ENVIRONMENT_ID
blossom environment:maintenance:disable --id ENVIRONMENT_ID --follow

Maintenance changes public routing only. Services, jobs and database connections keep running. Scale Services separately when you need them stopped. The same control is available under Environment Settings → Maintenance.

Previews

Previews use Account members by default, whatever their Environment uses. To give them the Environment’s own mode instead, choose Same as the Environment’s name, such as Same as production, for Access in Preview Settings. The setting covers all of the Environment’s Previews at once: a change there, including a new password, reaches every Preview within about 30 seconds.

A Preview’s Access tab shows what it inherits: the mode, password users, public paths and bypass tokens, each with where to change it. Its shareable links are its own. A Preview’s pull request comment says who can open it, and never includes a link, token or password.

Shareable Links

A shareable link lets someone without a Blossom login, such as a client, open an Account members Environment. It opens only the Environment or Preview it was made on. Links expire after 1, 7 (the default) or 30 days, or never.

blossom environment:access:link:create --environment ENVIRONMENT_ID --expires 30
blossom environment:access:link:show --id LINK_ID
blossom environment:access:link:revoke --id LINK_ID

Copy link on the Access tab, or link:show, gives a fresh URL for the same link. Revoking a link stops it within about 30 seconds.

Bypass Tokens

A bypass token lets automated tests, uptime monitors and screenshot tools through Account members. Send it as the X-Blossom-Access header:

blossom environment:access:token:create --environment ENVIRONMENT_ID --name CI
curl -H "X-Blossom-Access: $BLOSSOM_ACCESS_TOKEN" https://shop.example.com/

The token is shown once; store it as a secret in the tool that sends it. The Access tab shows only its last four characters, such as bxa_****k3f9, so you can match a token to its row. Tokens don’t expire unless you choose 30, 90 or 365 days; revoke one with environment:access:token:revoke.

Public Paths

Webhooks from Stripe, GitHub or an OAuth provider can’t sign in. List the paths that skip the sign-in under Advanced → Public paths, one per line; end a path with * to include everything under it:

blossom environment:update --id ENVIRONMENT_ID -d '{"environment":{"access_public_paths":["/webhooks/*"]}}'

Clear the list to turn them off. Public paths apply to the Environment’s Previews too. A request path containing \ or ; never counts as public.

Links and tokens are named for you, such as quiet-river; hover a name on the Access tab to rename it.