# Ports > A server on the box opens on your machine as localhost within about two seconds, with no flags or config, and any port can be shared at a link, with your workspace or with anyone you send it to. URL: https://prized.dev/docs/ports ## How it works [#how-it-works] A TCP port opens at the same number on your machine's 127.0.0.1, websockets included; servers bound only to the box's loopback (Vite, most dev servers) work too. On Windows this works while you are signed in. ```bash title="you@box ~/code/myproject" npm run dev # ready on http://localhost:3000 # two seconds later, localhost:3000 works on your machine ``` ## Inspect and toggle [#inspect-and-toggle] | Command | What it does | | ---------------------------- | --------------------------------------------------------------- | | `prized ports ls` | Every box listener, its process, and its mirror state. | | `prized ports toggle 3000` | Flip a port off or back on; the choice survives restarts. | | `prized proxy box-3fa9 5432` | Forward one port from any box to `127.0.0.1:5432` until Ctrl-C. | An interactive `prized ssh` or `prized mosh` session to a non-default box forwards that box's ports while it lasts. ## Limits [#limits] | Limit | What it means | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | TCP only | UDP is not forwarded. | | Ports 3000 through 9999 | Auto-mirrored; the range and per-port allow and never lists are in the config's `[ports]` section. | | Never mirrored | Ports below 1024, port 22, and the agent's port 7377; 5900 is off by default. Other ports outside the range need an allow-list entry or `prized proxy`. | | Open to your whole machine | Like `ssh -L` or `docker -p 127.0.0.1:`: on a machine shared with other accounts, treat a mirrored port as unprotected. | | Local wins | If something on your machine already uses the port, the mirror waits, `prized proxy` refuses it, and an `ssh` session skips it. | | Every request crosses the network | Run an app that makes many database round trips per page on the box, beside its database, and mirror only the app port. | ## Share a port [#share-a-port] `prized ports share 3000` gives the port a link your workspace's members open in a browser, with nothing to install. Two wider audiences need a paying workspace: `--anyone` (whoever holds the link) and `--public` (anyone at all, owner only). ```bash prized ports share 3000 # ✓ port 3000 on mango shared # https://mango-3000-k7x2q9.p.prized.dev/ ``` A link anyone can open for three days, for a client who has no Prized account: ```bash prized ports share 3000 --anyone --expires 3d ``` | Audience | Who opens it | Link | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Members (the default) | Members of your workspace who can see the box, after signing in to Prized; anyone else sees a page saying the link is not available to their account. | Under `p.prized.dev`; lasts until you stop sharing. | | Anyone with the link | Whoever holds the link, with no Prized account. The link carries a secret and is shown once, when you make it; lost, make a new one. | On a separate domain, never prized.dev; expires after 7 days by default, 5 minutes to 30 days. | | Public | Anyone at all. | On the same separate domain; same expiry. | The first visit to an anyone or public link from a browser shows a warning page: Prized did not make the page, so visitors should not type passwords into it unless they trust the sender. **Continue** opens the app; the browser is not asked again while its visit lasts. A port has one link: sharing it with another audience (`--anyone`, `--public`, or a different choice on the dashboard) replaces the link, and the old one stops working at once; `prized ports share 3000` with no flag on a shared port prints the link it has. The same choice is on the box page's Overview: click a port in the Machine tile's **Ports** row ([Dashboard](https://prized.dev/docs/dashboard#overview)); `prized ports share` with no port lists what the box shares. To share a port nothing listens on yet, click **+** at the end of the **Ports** row and type its number; nothing is shared until you click the button that names who can open it (**Make public for 7 days**, for example). | Topic | What happens | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | What it carries | HTTP and websockets, so hot reload works. The app sees itself reached as `localhost:3000`, so host and origin checks pass. Anything else (a database, SSH) needs [`prized proxy`](#inspect-and-toggle). | | A paused box | A members link wakes it, and the page retries until the box answers. An anyone or public link never wakes it: visitors see a page saying the box is asleep until someone in the workspace starts it. | | Who may make one | Any member makes a members link; a [contractor](https://prized.dev/docs/teams#roles) only on boxes they own. An anyone link: the owner and members, or the owner alone under the `anyoneLinksOwnerOnly` [policy](https://prized.dev/docs/teams#policies). A public link: the owner. Contractors make neither. | | Paying workspaces | Anyone and public links need a paid plan or a purchase of credit; the free credit makes members links only. A workspace holds up to 10 live anyone and public links at once ([Limits](https://prized.dev/docs/limits#sync-sessions-and-ports)). | | Stop sharing | `prized ports unshare 3000`, or **Stop sharing** on the dashboard, ends the link within a moment, open pages and websockets included; so does deleting the box or closing the workspace. Removing a member, or making them a contractor, ends their members access and the anyone and public links they made. | | Cookies | Each link has its own host. A cookie your app sets with a wider `Domain` is stored for that link alone, and your Prized sign-in never reaches the app. | | "Too many requests" | A browser or script is asking faster than a shared port serves, or a link has had many visitors in a minute; reload in a moment. | | The log | Sharing, stopping, each member's first opening, and every visitor's first opening of an anyone or public link are rows on the [audit log](https://prized.dev/docs/teams#what-is-recorded). | Links pass through the browser terminal's relay, which can see the traffic as it passes and stores nothing ([Security](https://prized.dev/docs/security#other-ways-in)). ## A second box [#a-second-box] A box connected with `prized setup --box mango` mirrors its own ports; aim commands at it with `prized --box mango ports ls` and `prized --box mango ports toggle 3000` ([Several boxes](https://prized.dev/docs/boxes#several-boxes)). The same port on two boxes collides on your machine: the second mirror shows as `conflicted` in `ports ls`; toggle it off on one box, or add it to `[ports].never` in that box's config.