Create a link
Open the deployment in the project’s Deployments tab and press Share (it only shows when the deployment has app files). Choose:
Each link is a random address on the panel,
https://<panel>/#/d/<token>. Copy it or show its QR code. A deployment can have up to 20 active links.
Creating and revoking links needs the Developer role; anyone who can see the project can list them.
The download page
The page shows the app (the project name), its version (the commit, or the deployment id for uploads) and a big download button for the visitor’s device: the APK on Android, the installer on Windows (.msi/.exe), macOS (.dmg/.pkg) and Linux (.deb, archive or jar). The other platforms are listed below. On a computer, a QR code opens the page on a phone.
Android App Bundles (.aab) are listed for Google Play but never offered first, because phones can’t install them.
When a link stops working
- Revoked by a project member.
- Expired.
- Files deleted: the platform keeps the files of the last 10 finished deployments per environment. When older ones are cleaned up, their links are revoked.
- Project deleted: its links are removed.
- Paused: while the project is suspended (free allowance used up or spend limit reached) the page says downloads are unavailable.
Billing
Downloads through a link count as the project’s bandwidth (BANDWIDTH_GB).
Security
- Tokens carry 128 random bits. Passwords are stored as Argon2id hashes, like account passwords.
- The right password is exchanged for a download grant valid for 30 minutes, signed with a key of its own link (HMAC-SHA256), so it works on every server replica and dies with the link.
- Password attempts are limited to 10 per 15 minutes per link and address, and 100 per hour per link.
- Only the deployment’s app files are served, never its source or other outputs.