Skip to main content
Secure access provides authentication for communication between SDK and controller. Sandbox controller is deployed within each sandbox, and it exposes the management interface used by SDK, including file-system operations, command execution, and other sandbox control capabilities. When secure access is disabled, possession of a sandbox ID is sufficient to invoke these interfaces, which may allow unauthorized control of the sandbox from within the environment.
Starting with SDK version v2.0.0, secure access is turned on automatically whenever a sandbox is created. Older custom templates might not support this, in which case a rebuild may be required.

​
Migration path

For custom templates created with envd earlier than v0.2.0, secure access is available only after the template is rebuilt You can set secure to false to temporarily turn off secure access during sandbox creation, but this is not recommended for production use because of security risks. You can use the novita template list command or view the templates list on the dashboard to check the template envd version .

​
Supported versions

Sandboxes created from templates with envd v0.2.0 or later support secure access without any additional configuration. In JavaScript and Python SDK, secure access was available as an optional configuration starting from v1.5.0. As of SDK v2.0.0, sandboxes are provisioned with secure access turned on by default.

​
Access sandbox API directly

When you interact with a sandbox without using one of the SDKs, you can send requests directly to the sandbox controller URL. For sandboxes running with secure access, direct API requests are accepted only if they include the access token generated at creation time. Include this token in the X-Access-Token header for all sandbox controller requests. Upload and download operations by URLs require pre-signed URLs. You are recommended to use SDK to generate them.

​
Disable secure access

It is not recommended to disable secure access, because it may expose the sandbox to security risks. 
import { Sandbox } from 'novita-sandbox/code-interpreter'

const sandbox = await Sandbox.create({ secure: false }) // Explicitly disable
Last modified on June 10, 2026