# Secured access (/docs/sandbox/secured-access)

<!-- agent-signals: reading_time_min: 2 · est_tokens: 757 · updated: 2026-07-30 -->
Related: [Auto-resume on request](/docs/sandbox/auto-resume.md), [Connect to running sandbox](/docs/sandbox/connect.md), [Environment variables](/docs/sandbox/environment-variables.md), [Filesystem-only snapshots](/docs/sandbox/filesystem-only-snapshots.md), [Sandbox forking](/docs/sandbox/fork.md), [Git integration](/docs/sandbox/git-integration.md)

Secure access authenticates communication between SDK and sandbox controller.

Sandbox controller runs in sandbox itself and exposes APIs for work with file system, run commands, and generally control the sandbox via our SDK.
Without secure access, anyone with a sandbox ID can access the controller APIs and control the sandbox from inside.

<Note>
  SDKs version `v2.0.0` and above are using secure access by default when creating sandbox. This may not be compatible with older custom templates and you may need to rebuild them.
</Note>

## Migration path [#migration-path]

When using custom templates created before envd `v0.2.0`, you need to rebuild the templates to enable secure access.
Temporarily, you can disable secure access by setting `secure` to `false` during sandbox creation, but this is not recommended for production use because it increases security risks.

You can check the template envd version using the `e2b template list` command or by viewing the templates list on the dashboard.

## Supported versions [#supported-versions]

All sandboxes based on templates with envd version at least `v0.2.0` already support secure access without any additional changes.

The secure access flag was introduced in `1.5.0` for JavaScript and Python SDKs to be used optionally.
Starting with SDK version `v2.0.0`, sandboxes are created with secure access enabled by default.

## Access sandbox API directly [#access-sandbox-api-directly]

In some cases, you might want to access sandbox controller APIs directly through its URL, such as when you are not using SDKs.
When secure access is enabled, you must provide an authentication token that was returned during sandbox creation.

Each call to the sandbox controller must include an additional header `X-Access-Token` with the access token value returned during sandbox creation.

For sandbox [upload](/docs/filesystem/upload#upload-with-pre-signed-url) and [download](/docs/filesystem/download#download-with-pre-signed-url) URLs, you need to generate pre-signed URLs. We are advising to use SDK for generating presigned URLs.

## Disable secure access [#disable-secure-access]

Disabling secured access is discouraged because it creates security vulnerabilities.

<CodeGroup>
  <CodeBlockTabs defaultValue="JavaScript & TypeScript" groupId="javascript-typescript+python">
    <CodeBlockTabsList>
      <CodeBlockTabsTrigger value="JavaScript & TypeScript">
        JavaScript & TypeScript
      </CodeBlockTabsTrigger>

      <CodeBlockTabsTrigger value="Python">
        Python
      </CodeBlockTabsTrigger>
    </CodeBlockTabsList>

    <CodeBlockTab value="JavaScript & TypeScript">
      ```js  
      import { Sandbox } from 'e2b'

      const sandbox = await Sandbox.create({ secure: false }) // Explicitly disable
      ```
    </CodeBlockTab>

    <CodeBlockTab value="Python">
      ```python  
      from e2b import Sandbox

      sandbox = Sandbox.create(secure=False)  # Explicitly disable
      ```
    </CodeBlockTab>
  </CodeBlockTabs>
</CodeGroup>