# Restrict public access
<subtitle>Requires callers to authenticate with a token to access the sandbox's public URL. </subtitle>

By default, the sandbox's [public URL](/docs/agent-sandbox/network/public-url.md) is accessible to anyone who knows it. For sensitive workloads, you can require callers to authenticate using each sandbox's token before any request reaches the internal service.

## Restrict public access to sandbox URLs

By default, the sandbox URL is publicly accessible. You can restrict access by requiring authentication using the `allow_public_traffic` option:

```python
import requests
from ucloud_sandbox import Sandbox

# Create a sandbox that restricts public access
sandbox = Sandbox.create(
    network={
        "allow_public_traffic": False
    }
)

# The sandbox has a traffic access token
print(sandbox.traffic_access_token)

# Start the server in the sandbox
sandbox.commands.run("python -m http.server 8080", background=True)

host = sandbox.get_host(8080)
url = f"https://{host}"

# Requests without token will return 403 failure
response1 = requests.get(url)
print(response1.status_code)  # 403

# Requests with token will succeed
response2 = requests.get(url, headers={
    'e2b-traffic-access-token': sandbox.traffic_access_token
})
print(response2.status_code)  # 200
```

When `allow_public_traffic` is set to false, all requests to the sandbox public URL must include the `e2b-traffic-access-token` header with the value from `sandbox.traffic_access_token`.