# Preview protection

Pushes to branches other than the production branch are deployed to preview addresses. This decides who can open them.

```
get_preview_protection   the current setting, scope, bypass keys and share links
set_preview_protection   off | members | password
set_protection_scope     what is protected (previews | generated | all), addresses let in, paths that pass
create_bypass_secret     create a bypass key (shown once)
revoke_bypass_secret     revoke a bypass key
create_share_link        a link that opens one deployment or one branch (1 to 30 days)
revoke_share_link        revoke a share link
```

- **members**: only people in this organization who are signed in to the console. The default for new projects.
- **password**: with a single password. For showing customers who have no account.
- **off**: anyone who knows the address.

The production address and connected domains are always public. The `dpl-…` address each deployment gets is protected even for production builds.

Where you cannot sign in, such as E2E tests, send a bypass key made with `create_bypass_secret`
in the `x-blackwall-protection-bypass` header. An assistant checking a preview it deployed uses the same key.
With scope generated in `set_protection_scope`, production's own address is protected too; with all, connected domains as well.

## Environments

Beside production and branch previews, a project can make environments such as staging, each with its own address, domains and environment variables.

```
list_environments        production and the project's own environments, the branch each follows, address, domains
create_environment       create one (name, branch, auto_assign)
update_environment       change the branch it follows and whether it takes builds by itself
remove_environment       remove one (its name in confirm)
set_domain_environment   point a verified domain at an environment
```

Give an environment its variables with its name as the target in `set_env_vars`. One with auto_assign false changes only through `promote_deployment`. Only owners and admins can change environments.

## Branch previews

```
get_branch_previews   the current setting (branch_previews: true | false)
set_branch_previews   enabled: true | false
```

An organization-wide setting. false builds only what reaches the production branch (usually main); a branch push stays in the deployment history as skipped. Redeploys, uploads and deploy hooks still build. Only owners and admins can change it.
Over REST: `GET·PUT /v1/projects/<ref>/branch-previews {enabled}`. In the CLI: `oneend deployments branch-previews [on|off]`. In the console: Organization → Deployment policies → Branch previews.

---

https://end.blackall.ai/docs/previews?lang=en