Viewer links

POST /v1/machines/{id}/viewer returns {"url":"https://api.usepanes.com/view/…?token=…","expires_in":"1h"}. Anyone with the URL can watch and control that computer for an hour. Keep it private.

An open viewer keeps the computer active for auto-stop purposes. The viewer uses WebSockets on the API origin. The signed VNC and SSH transport URLs are machine-scoped grants, not general API keys.

POST /v1/machines/{id}/ssh returns a signed wss://…/ssh?token=… URL and expires_at. It transports SSH bytes over WebSockets. SSH authentication and host-key verification still happen end to end; the URL is not an SSH username or password.