<titledata-rh="true">Permission Modes | Zrok</title><metadata-rh="true"name="viewport"content="width=device-width,initial-scale=1"><metadata-rh="true"name="twitter:card"content="summary_large_image"><metadata-rh="true"property="og:url"content="https://docs.zrok.io/docs/guides/permission-modes/"><metadata-rh="true"property="og:locale"content="en"><metadata-rh="true"name="docusaurus_locale"content="en"><metadata-rh="true"name="docsearch:language"content="en"><metadata-rh="true"name="docusaurus_version"content="current"><metadata-rh="true"name="docusaurus_tag"content="docs-default-current"><metadata-rh="true"name="docsearch:version"content="current"><metadata-rh="true"name="docsearch:docusaurus_tag"content="docs-default-current"><metadata-rh="true"property="og:title"content="Permission Modes | Zrok"><metadata-rh="true"name="description"content="Shares created in zrok v0.4.26 and newer now include a choice of permission mode."><metadata-rh="true"property="og:description"content="Shares created in zrok v0.4.26 and newer now include a choice of permission mode."><linkdata-rh="true"rel="icon"href="/img/space-ziggy.png"><linkdata-rh="true"rel="canonical"href="https://docs.zrok.io/docs/guides/permission-modes/"><linkdata-rh="true"rel="alternate"href="https://docs.zrok.io/docs/guides/permission-modes/"hreflang="en"><linkdata-rh="true"rel="alternate"href="https://docs.zrok.io/docs/guides/permission-modes/"hreflang="x-default"><linkdata-rh="true"rel="preconnect"href="https://CO73R59OLO-dsn.algolia.net"crossorigin="anonymous"><linkrel="preconnect"href="https://www.googletagmanager.com">
<p>Shares created in zrok <code>v0.4.26</code> and newer now include a choice of <em>permission mode</em>.</p>
<p>Shares created with zrok <code>v0.4.25</code> and older were created using what is now called the <em>open permission mode</em>. Whether <em>public</em> or <em>private</em>, these shares can be accessed by any user of the zrok service instance, as long as they know the <em>share token</em> of the share. Effectively shares with the <em>open permission mode</em> are accessible by any user of the zrok service instance.</p>
<p>zrok now supports a <em>closed permission mode</em>, which allows for more fine-grained control over which zrok users are allowed to privately access your shares using <code>zrok access private</code>.</p>
<p>zrok defaults to continuing to create shares with the <em>open permission mode</em>. This will likely change in a future release. We're leaving the default behavior in place to allow users a period of time to get comfortable with the new permission modes.</p>
<h2class="anchor anchorWithStickyNavbar_LWe7"id="creating-a-share-with-closed-permission-mode">Creating a Share with Closed Permission Mode<ahref="#creating-a-share-with-closed-permission-mode"class="hash-link"aria-label="Direct link to Creating a Share with Closed Permission Mode"title="Direct link to Creating a Share with Closed Permission Mode"></a></h2>
<p>Adding the <code>--closed</code> flag to the <code>zrok share</code> or <code>zrok reserve</code> commands will create shares using the <em>closed permission mode</em>:</p>
<divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"style="color:#F8F8F2;background-color:#282A36"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">$ zrok share private --headless --closed -b web .</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">[ 0.066] INFO main.(*sharePrivateCommand).run: allow other to access your share with the following command:</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">zrok access private 0vzwzodf0c7g</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div>
<p>By default any environment owned by the account that created the share is <em>allowed</em> to access the new share. But a user trying to access the share from an environment owned by a different account will enounter the following error message:</p>
<p>The <code>zrok share</code> and <code>zrok reserve</code> commands now include an <code>--access-grant</code> flag, which allows you to specify additional zrok accounts that are allowed to access your shares:</p>
<divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"style="color:#F8F8F2;background-color:#282A36"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">$ zrok share private --headless --closed --access-grant anotheruser@test.com -b web .</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">[ 0.062] INFO main.(*sharePrivateCommand).run: allow other to access your share with the following command:</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">zrok access private y6h4at5xvn6o</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div>
<p>And now <code>anotheruser@test.com</code> will be allowed to access the share:</p>
<divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"style="color:#F8F8F2;background-color:#282A36"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">$ zrok access private --headless y6h4at5xvn6o</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">[ 0.049] INFO main.(*accessPrivateCommand).run: allocated frontend 'VyvrJihAOEHD'</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">[ 0.051] INFO main.(*accessPrivateCommand).run: access the zrok share at the following endpoint: http://127.0.0.1:9191</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div>
<h2class="anchor anchorWithStickyNavbar_LWe7"id="adding-and-removing-access-grants-for-existing-shares">Adding and Removing Access Grants for Existing Shares<ahref="#adding-and-removing-access-grants-for-existing-shares"class="hash-link"aria-label="Direct link to Adding and Removing Access Grants for Existing Shares"title="Direct link to Adding and Removing Access Grants for Existing Shares"></a></h2>
<p>If you've created a share (either reserved or ephemeral) and you forgot to include an access grant, or want to remove an access grant that was mistakenly added, you can use the <code>zrok modify share</code> command to make the adjustments:</p>
<p>Create a share:</p>
<divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"style="color:#F8F8F2;background-color:#282A36"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">$ zrok share private --headless --closed -b web .</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">[ 0.064] INFO main.(*sharePrivateCommand).run: allow other to access your share with the following command:</span><br></span><spanclass="token-line"style="color:#F8F8F2"><spanclass="token plain">zrok access private s4czjylwk7wa</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div>
<p>In another shell in the same environment you can execute:</p>
<h2class="anchor anchorWithStickyNavbar_LWe7"id="limitations">Limitations<ahref="#limitations"class="hash-link"aria-label="Direct link to Limitations"title="Direct link to Limitations"></a></h2>
