Add an app hosted elsewhere

Most teams already have an internal tool running somewhere before they ever touch Volly. You don’t need to rebuild it to bring it in. External URL apps let that tool stay exactly where it is: Volly just adds a place for it in your company directory and a sign-in gate so only your workspace can reach it.

Building something new instead, and it just needs to read from a company database or call an internal API? Use external resources — no gating required there.

Once it’s set up, your team opens the app at a normal Volly address like https://acme-reports.volly.so, signs in with their work account, and Volly passes their requests through to your server.

How it stays secure

Your server is still on the open internet; Volly doesn’t hide it. Instead, it attaches a signed, short-lived token (the X-Volly-Jwt header) to every request it forwards, proving the visitor is a signed-in member of your workspace. Your app has to check that token and reject anything without a valid one. That check is the whole thing keeping strangers out, so Volly won’t switch the app on until it’s confirmed the check actually works.

It sounds like a lot, but it’s a few lines of code, and you don’t have to write them from scratch (see below).

Caution

Because the origin server stays publicly reachable, you’ll need to make a code change to your application so it only accepts traffic coming through Volly.

Set it up

1. Create the project. In the publish wizard, choose External URL and enter where the tool is hosted (an https:// address). You’ll also pick a short reason it lives outside Volly, which helps us improve hosting support over time.
2. Add the token check to your app. The app needs to reject any request whose token isn’t valid. There’s an example repo, volly-app/example-gated-verification, with working verification code and an agent skill that wires it into your project for you.
3. Run the check. On the project page, click Run origin check. Volly probes your server four ways: it rejects requests with no token, rejects expired tokens, rejects tokens minted for a different app, and accepts a valid one.

When all four pass, the app goes live in your directory. If any fail, the page shows which ones so you can fix them and run it again. Until then, visitors see a “Not available yet” page and Volly serves nothing.

Good to know

• Changing the hosted URL re-runs the gate. Point the app at a different address and it switches off until the new one passes the check.
• Your app knows who’s visiting. The token carries the signed-in viewer’s email, so your tool can show per-person content without running its own login system.
• No uploads, no drafts. External URL apps have nothing deployed on Volly. Updates happen wherever the app is actually hosted.