# Panes

Canonical: https://usepanes.com/docs/viewer

## Viewer links

POST `/v1/machines/{id}/viewer` returns `{"url":"https://api.usepanes.com/view/…?token=…","expires_in":"1h"}`. Anyone with the URL can watch and control that computer for an hour. Keep it private.

An open viewer keeps the computer active for auto-stop purposes. The viewer uses WebSockets on the API origin. The signed VNC and SSH transport URLs are machine-scoped grants, not general API keys.

POST `/v1/machines/{id}/ssh` returns a signed `wss://…/ssh?token=…` URL and `expires_at`. It transports SSH bytes over WebSockets. SSH authentication and host-key verification still happen end to end; the URL is not an SSH username or password.