Skip to main content
Secure access authenticates communication between SDK and sandbox controller. Sandbox controller runs in sandbox itself and exposes APIs for work with file system, run commands, and generally control the sandbox via our SDK. Without secure access, anyone with a sandbox ID can access the controller APIs and control the sandbox from inside.
SDKs version v2.0.0 and above are using secure access by default when creating sandbox. This may not be compatible with older custom templates and you may need to rebuild them.

​
Migration path

When using custom templates created before envd v0.2.0, you need to rebuild the templates to enable secure access. Temporarily, you can disable secure access by setting secure to false during sandbox creation, but this is not recommended for production use because it increases security risks. You can check the template envd version using the e2b template list command or by viewing the templates list on the dashboard.

​
Supported versions

All sandboxes based on templates with envd version at least v0.2.0 already support secure access without any additional changes. The secure access flag was introduced in 1.5.0 for JavaScript and Python SDKs to be used optionally. Starting with SDK version v2.0.0, sandboxes are created with secure access enabled by default.

​
Access sandbox API directly

In some cases, you might want to access sandbox controller APIs directly through its URL, such as when you are not using SDKs. When secure access is enabled, you must provide an authentication token that was returned during sandbox creation. Each call to the sandbox controller must include an additional header X-Access-Token with the access token value returned during sandbox creation. For sandbox upload and download URLs, you need to generate pre-signed URLs. We are advising to use SDK for generating presigned URLs.

​
Disable secure access

Disabling secured access is discouraged because it creates security vulnerabilities. 
import { Sandbox } from '@e2b/code-interpreter'

const sandbox = await Sandbox.create({ secure: false }) // Explicitly disable