diff --git a/cmd/zrok/reserve.go b/cmd/zrok/reserve.go
index 68c4c123..44391649 100644
--- a/cmd/zrok/reserve.go
+++ b/cmd/zrok/reserve.go
@@ -6,6 +6,7 @@ import (
 	"github.com/openziti/zrok/model"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/sdk"
 	"github.com/openziti/zrok/tui"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -39,8 +40,8 @@ func newReserveCommand() *reserveCommand {
 }
 
 func (cmd *reserveCommand) run(_ *cobra.Command, args []string) {
-	shareMode := args[0]
-	if shareMode != "public" && shareMode != "private" {
+	shareMode := sdk.ShareMode(args[0])
+	if shareMode != sdk.PublicShareMode && shareMode != sdk.PrivateShareMode {
 		tui.Error("invalid sharing mode; expecting 'public' or 'private'", nil)
 	}
 
@@ -83,13 +84,13 @@ func (cmd *reserveCommand) run(_ *cobra.Command, args []string) {
 	req := share.NewShareParams()
 	req.Body = &rest_model_zrok.ShareRequest{
 		EnvZID:               env.Environment().ZitiIdentity,
-		ShareMode:            shareMode,
+		ShareMode:            string(shareMode),
 		BackendMode:          cmd.backendMode,
 		BackendProxyEndpoint: target,
 		AuthScheme:           string(model.None),
 		Reserved:             true,
 	}
-	if shareMode == "public" {
+	if shareMode == sdk.PublicShareMode {
 		req.Body.FrontendSelection = cmd.frontendSelection
 	}
 	if len(cmd.basicAuth) > 0 {
diff --git a/cmd/zrok/sharePrivate.go b/cmd/zrok/sharePrivate.go
index 967a2772..1397fc40 100644
--- a/cmd/zrok/sharePrivate.go
+++ b/cmd/zrok/sharePrivate.go
@@ -14,6 +14,7 @@ import (
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/sdk"
 	"github.com/openziti/zrok/tui"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -110,7 +111,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 	req := share.NewShareParams()
 	req.Body = &rest_model_zrok.ShareRequest{
 		EnvZID:               env.Environment().ZitiIdentity,
-		ShareMode:            "private",
+		ShareMode:            string(sdk.PrivateShareMode),
 		BackendMode:          cmd.backendMode,
 		BackendProxyEndpoint: target,
 		AuthScheme:           string(model.None),
@@ -231,7 +232,7 @@ func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 
 	} else {
 		shareDescription := fmt.Sprintf("access your share with: %v", tui.Code.Render(fmt.Sprintf("zrok access private %v", resp.Payload.ShrToken)))
-		mdl := newShareModel(resp.Payload.ShrToken, []string{shareDescription}, "private", cmd.backendMode)
+		mdl := newShareModel(resp.Payload.ShrToken, []string{shareDescription}, sdk.PrivateShareMode, sdk.BackendMode(cmd.backendMode))
 		logrus.SetOutput(mdl)
 		prg := tea.NewProgram(mdl, tea.WithAltScreen())
 		mdl.prg = prg
diff --git a/cmd/zrok/sharePublic.go b/cmd/zrok/sharePublic.go
index 0123fc5a..6a94aeb1 100644
--- a/cmd/zrok/sharePublic.go
+++ b/cmd/zrok/sharePublic.go
@@ -12,6 +12,7 @@ import (
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/sdk"
 	"github.com/openziti/zrok/tui"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -104,7 +105,7 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 	req := share.NewShareParams()
 	req.Body = &rest_model_zrok.ShareRequest{
 		EnvZID:               env.Environment().ZitiIdentity,
-		ShareMode:            "public",
+		ShareMode:            string(sdk.PublicShareMode),
 		FrontendSelection:    cmd.frontendSelection,
 		BackendMode:          cmd.backendMode,
 		BackendProxyEndpoint: target,
@@ -185,7 +186,7 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 		}
 
 	} else {
-		mdl := newShareModel(resp.Payload.ShrToken, resp.Payload.FrontendProxyEndpoints, "public", cmd.backendMode)
+		mdl := newShareModel(resp.Payload.ShrToken, resp.Payload.FrontendProxyEndpoints, sdk.PublicShareMode, sdk.BackendMode(cmd.backendMode))
 		logrus.SetOutput(mdl)
 		prg := tea.NewProgram(mdl, tea.WithAltScreen())
 		mdl.prg = prg
diff --git a/cmd/zrok/shareReserved.go b/cmd/zrok/shareReserved.go
index 345dbc5a..f5dd54ce 100644
--- a/cmd/zrok/shareReserved.go
+++ b/cmd/zrok/shareReserved.go
@@ -10,6 +10,7 @@ import (
 	"github.com/openziti/zrok/rest_client_zrok/metadata"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/sdk"
 	"github.com/openziti/zrok/tui"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -144,10 +145,10 @@ func (cmd *shareReservedCommand) run(_ *cobra.Command, args []string) {
 
 	if cmd.headless {
 		switch resp.Payload.ShareMode {
-		case "public":
+		case string(sdk.PublicShareMode):
 			logrus.Infof("access your zrok share: %v", resp.Payload.FrontendEndpoint)
 
-		case "private":
+		case string(sdk.PrivateShareMode):
 			logrus.Infof("use this command to access your zrok share: 'zrok access private %v'", shrToken)
 		}
 		for {
@@ -159,13 +160,13 @@ func (cmd *shareReservedCommand) run(_ *cobra.Command, args []string) {
 	} else {
 		var shareDescription string
 		switch resp.Payload.ShareMode {
-		case "public":
+		case string(sdk.PublicShareMode):
 			shareDescription = resp.Payload.FrontendEndpoint
-		case "private":
+		case string(sdk.PrivateShareMode):
 			shareDescription = fmt.Sprintf("access your share with: %v", tui.Code.Render(fmt.Sprintf("zrok access private %v", shrToken)))
 		}
 
-		mdl := newShareModel(shrToken, []string{shareDescription}, resp.Payload.ShareMode, resp.Payload.BackendMode)
+		mdl := newShareModel(shrToken, []string{shareDescription}, sdk.ShareMode(resp.Payload.ShareMode), sdk.BackendMode(resp.Payload.BackendMode))
 		logrus.SetOutput(mdl)
 		prg := tea.NewProgram(mdl, tea.WithAltScreen())
 		mdl.prg = prg
diff --git a/cmd/zrok/shareTui.go b/cmd/zrok/shareTui.go
index 123b8868..1b709fd5 100644
--- a/cmd/zrok/shareTui.go
+++ b/cmd/zrok/shareTui.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"fmt"
+	"github.com/openziti/zrok/sdk"
 	"strings"
 	"time"
 
@@ -19,8 +20,8 @@ var wordwrapBreakpoints = map[rune]bool{' ': true, '-': true}
 type shareModel struct {
 	shrToken             string
 	frontendDescriptions []string
-	shareMode            string
-	backendMode          string
+	shareMode            sdk.ShareMode
+	backendMode          sdk.BackendMode
 	requests             []*endpoints.Request
 	log                  []string
 	showLog              bool
@@ -32,7 +33,7 @@ type shareModel struct {
 
 type shareLogLine string
 
-func newShareModel(shrToken string, frontendEndpoints []string, shareMode, backendMode string) *shareModel {
+func newShareModel(shrToken string, frontendEndpoints []string, shareMode sdk.ShareMode, backendMode sdk.BackendMode) *shareModel {
 	return &shareModel{
 		shrToken:             shrToken,
 		frontendDescriptions: frontendEndpoints,
@@ -116,15 +117,15 @@ func (m *shareModel) adjustPaneHeights() {
 func (m *shareModel) renderConfig() string {
 	out := "["
 	if m.shareMode == "public" {
-		out += shareModePublicStyle.Render(strings.ToUpper(m.shareMode))
+		out += shareModePublicStyle.Render(strings.ToUpper(string(m.shareMode)))
 	} else {
-		out += shareModePrivateStyle.Render(strings.ToUpper(m.shareMode))
+		out += shareModePrivateStyle.Render(strings.ToUpper(string(m.shareMode)))
 	}
 	out += "] ["
 	if m.backendMode == "proxy" {
-		out += backendModeProxyStyle.Render(strings.ToUpper(m.backendMode))
+		out += backendModeProxyStyle.Render(strings.ToUpper(string(m.backendMode)))
 	} else {
-		out += backendModeWebStyle.Render(strings.ToUpper(m.backendMode))
+		out += backendModeWebStyle.Render(strings.ToUpper(string(m.backendMode)))
 	}
 	out += "]"
 	return out
diff --git a/cmd/zrok/testLoopPublic.go b/cmd/zrok/testLoopPublic.go
index 6e14baa5..0a92cae9 100644
--- a/cmd/zrok/testLoopPublic.go
+++ b/cmd/zrok/testLoopPublic.go
@@ -14,6 +14,7 @@ import (
 	"github.com/openziti/zrok/rest_client_zrok"
 	"github.com/openziti/zrok/rest_client_zrok/share"
 	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/sdk"
 	"github.com/openziti/zrok/tui"
 	"github.com/openziti/zrok/util"
 	"github.com/sirupsen/logrus"
@@ -198,9 +199,9 @@ func (l *looper) startup() {
 	tunnelReq := share.NewShareParams()
 	tunnelReq.Body = &rest_model_zrok.ShareRequest{
 		EnvZID:               l.env.ZitiIdentity,
-		ShareMode:            "public",
+		ShareMode:            string(sdk.PublicShareMode),
 		FrontendSelection:    l.cmd.frontendSelection,
-		BackendMode:          "proxy",
+		BackendMode:          string(sdk.ProxyBackendMode),
 		BackendProxyEndpoint: fmt.Sprintf("looper#%d", l.id),
 		AuthScheme:           string(model.None),
 	}
diff --git a/controller/limits/accountRelaxAction.go b/controller/limits/accountRelaxAction.go
index 82e66476..7339b04e 100644
--- a/controller/limits/accountRelaxAction.go
+++ b/controller/limits/accountRelaxAction.go
@@ -4,6 +4,7 @@ import (
 	"github.com/jmoiron/sqlx"
 	"github.com/openziti/zrok/controller/store"
 	"github.com/openziti/zrok/controller/zrokEdgeSdk"
+	"github.com/openziti/zrok/sdk"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
@@ -38,11 +39,11 @@ func (a *accountRelaxAction) HandleAccount(acct *store.Account, _, _ int64, _ *B
 
 		for _, shr := range shrs {
 			switch shr.ShareMode {
-			case "public":
+			case string(sdk.PublicShareMode):
 				if err := relaxPublicShare(a.str, edge, shr, trx); err != nil {
 					return errors.Wrap(err, "error relaxing public share")
 				}
-			case "private":
+			case string(sdk.PrivateShareMode):
 				if err := relaxPrivateShare(a.str, edge, shr, trx); err != nil {
 					return errors.Wrap(err, "error relaxing private share")
 				}
diff --git a/controller/limits/environmentRelaxAction.go b/controller/limits/environmentRelaxAction.go
index 19d8a115..e4e7b657 100644
--- a/controller/limits/environmentRelaxAction.go
+++ b/controller/limits/environmentRelaxAction.go
@@ -4,6 +4,7 @@ import (
 	"github.com/jmoiron/sqlx"
 	"github.com/openziti/zrok/controller/store"
 	"github.com/openziti/zrok/controller/zrokEdgeSdk"
+	"github.com/openziti/zrok/sdk"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
@@ -33,11 +34,11 @@ func (a *environmentRelaxAction) HandleEnvironment(env *store.Environment, rxByt
 	for _, shr := range shrs {
 		if !shr.Deleted {
 			switch shr.ShareMode {
-			case "public":
+			case string(sdk.PublicShareMode):
 				if err := relaxPublicShare(a.str, edge, shr, trx); err != nil {
 					return err
 				}
-			case "private":
+			case string(sdk.PrivateShareMode):
 				if err := relaxPrivateShare(a.str, edge, shr, trx); err != nil {
 					return err
 				}
diff --git a/controller/limits/shareRelaxAction.go b/controller/limits/shareRelaxAction.go
index 55e0a2c9..f90dd41c 100644
--- a/controller/limits/shareRelaxAction.go
+++ b/controller/limits/shareRelaxAction.go
@@ -5,6 +5,7 @@ import (
 	"github.com/openziti/edge-api/rest_management_api_client"
 	"github.com/openziti/zrok/controller/store"
 	"github.com/openziti/zrok/controller/zrokEdgeSdk"
+	"github.com/openziti/zrok/sdk"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
@@ -28,11 +29,11 @@ func (a *shareRelaxAction) HandleShare(shr *store.Share, _, _ int64, _ *Bandwidt
 		}
 
 		switch shr.ShareMode {
-		case "public":
+		case string(sdk.PublicShareMode):
 			if err := relaxPublicShare(a.str, edge, shr, trx); err != nil {
 				return err
 			}
-		case "private":
+		case string(sdk.PrivateShareMode):
 			if err := relaxPrivateShare(a.str, edge, shr, trx); err != nil {
 				return err
 			}
diff --git a/controller/share.go b/controller/share.go
index 0471f59e..860c106b 100644
--- a/controller/share.go
+++ b/controller/share.go
@@ -7,6 +7,7 @@ import (
 	"github.com/openziti/zrok/controller/zrokEdgeSdk"
 	"github.com/openziti/zrok/rest_model_zrok"
 	"github.com/openziti/zrok/rest_server_zrok/operations/share"
+	"github.com/openziti/zrok/sdk"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
@@ -68,7 +69,7 @@ func (h *shareHandler) Handle(params share.ShareParams, principal *rest_model_zr
 	var shrZId string
 	var frontendEndpoints []string
 	switch params.Body.ShareMode {
-	case "public":
+	case string(sdk.PublicShareMode):
 		if len(params.Body.FrontendSelection) < 1 {
 			logrus.Info("no frontend selection provided")
 			return share.NewShareNotFound()
@@ -94,7 +95,7 @@ func (h *shareHandler) Handle(params share.ShareParams, principal *rest_model_zr
 			return share.NewShareInternalServerError()
 		}
 
-	case "private":
+	case string(sdk.PrivateShareMode):
 		logrus.Info("doing private")
 		shrZId, frontendEndpoints, err = newPrivateResourceAllocator().allocate(envZId, shrToken, params, edge)
 		if err != nil {
@@ -123,7 +124,7 @@ func (h *shareHandler) Handle(params share.ShareParams, principal *rest_model_zr
 	}
 	if len(frontendEndpoints) > 0 {
 		sshr.FrontendEndpoint = &frontendEndpoints[0]
-	} else if sshr.ShareMode == "private" {
+	} else if sshr.ShareMode == string(sdk.PrivateShareMode) {
 		sshr.FrontendEndpoint = &sshr.ShareMode
 	}