# spin port

**Spinbox is experimental: APIs change and data may be lost.** What is built and what proves it is on [Status](https://spin-stack.github.io/website/reference/status.md); what Spinbox does not do is on [Limitations](https://spin-stack.github.io/website/overview/limitations.md).

> spin port: Manage exposed ports for workspaces.

<!-- Generated by tools/refgen from spin:cmd/cli. Edit the source, not this file. -->

```
Manage exposed ports for workspaces

Usage:
  spin port [flags]
  spin port [command]

Available Commands:
  access      Change who may reach a port
  expose      Expose a port on a workspace
  grant       Let another user reach a port
  list        List exposed ports for a workspace
  revoke      Stop another user reaching a port
  unexpose    Unexpose a port from a workspace

Flags:
  -h, --help   help for port

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin port [command] --help" for more information about a command.
```

### spin port access

```
Change who may reach a published port.

  private    only you
  whitelist  you, and the users granted with "spin port grant"
  public     anyone at all, with no sign-in

Going private does not forget who the port was shared with: the grants stay, and come back
when you set it to whitelist again.

Usage:
  spin port access <workspace> <port> <private|whitelist|public> [flags]

Flags:
  -h, --help   help for access

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin port expose

```
Expose a TCP port on a workspace to make it reachable through the proxy.

Exposing a port is not publishing it: without --access it is private, and only you can
reach it. Widen it deliberately, with --access or with "spin port access".

  private    only you (the default)
  whitelist  you, and the users you grant it to with "spin port grant"
  public     anyone at all, with no sign-in

Port 22 (SSH) is always reachable by the workspace's owner.

With --https the proxy speaks TLS to the port without verifying its certificate, and the
port is reached only as {port}s-<workspace>: {port}-<workspace> is refused.

Examples:
  spin port expose myworkspace 3000
  spin port expose myworkspace 3000 --access public --description "demo"
  spin port expose myworkspace 8080 --https --description "API server"

Usage:
  spin port expose <workspace> <port> [flags]

Flags:
      --access string        who may reach it: private (the default), whitelist or public
      --description string   Description of the exposed port
  -h, --help                 help for expose
      --https                The port speaks TLS; the proxy does not verify its certificate, and its URL is {port}s-

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin port grant

```
Let another user reach a published port.

Granting does not widen the port on its own: it takes effect when the port's access is
whitelist, which is deliberate - "share this with Ana" must not quietly publish a port that
was private.

The user needs an account on this instance already.

Usage:
  spin port grant <workspace> <port> <user-id> [flags]

Flags:
  -h, --help   help for grant

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin port list

```
List all exposed ports for a workspace.

Port 22 (SSH) is always exposed by default and is not shown in this list.

Examples:
  spin port list myworkspace

Usage:
  spin port list <workspace> [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin port revoke

```
Stop another user reaching a published port.

It takes effect on their next request. Revoking somebody who was not granted succeeds:
you asked for them not to have access, and they do not.

Usage:
  spin port revoke <workspace> <port> <user-id> [flags]

Flags:
  -h, --help   help for revoke

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin port unexpose

```
Remove port exposure from a workspace.

Port 22 (SSH) cannot be unexposed.

Examples:
  spin port unexpose myworkspace 3000
  spin port unexpose myworkspace 8080

Usage:
  spin port unexpose <workspace> <port> [flags]

Flags:
  -h, --help   help for unexpose

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```