Web Apps and sharing

A Web App lets people use a Handler from a browser. Only the owner and people invited by email can open it. There is no public mode that lets anyone in.

1. Save the code

Save this as hello-web.js:

export default {
  async fetch(request, env) {
    return new Response('<!doctype html><h1>Hello, Wings</h1>', {
      headers: { 'Content-Type': 'text/html; charset=utf-8' },
    })
  },
}

2. Create the Web App

wings handler deploy --name hello-web --file hello-web.js
wings handler list

Replace <handler-id> with the ID from the list. Then create a Web App and get its URL:

wings trigger add-web <handler-id> --slug hello-web
wings trigger list <handler-id>
wings trigger url <handler-id> <trigger-id>

Replace <trigger-id> with the ID from the Trigger list. Open the returned URL in your browser and sign in through the Console. You should see “Hello, Wings”.

Signing in and out

An app session lasts 24 hours. Signing out of the Console normally signs you out of the app too. If you see a warning that Web App sign-out failed, the app session may remain active for up to 24 hours. Check for that warning when using a shared computer.

Disabling or deleting the app also ends its sessions. Removing a share ends that person's sessions. Disabling keeps the sharing settings; deleting the app removes them.

Invite people

wings trigger share <handler-id> <trigger-id> --email teammate@example.com
wings trigger shares <handler-id> <trigger-id>
wings trigger unshare <handler-id> <trigger-id> --email teammate@example.com

Wings does not send invitation emails. After adding a share, give the person the app URL. They sign in with an AGI Lab account using the invited address. A free account is enough. Viewing the app does not create a Wings workspace or start their Free allowance.

Removing a share does not reduce the number of additions in the last 24 hours. Use shares to check the current count and limits. If you receive sharing_unavailable, this account cannot add shares yet. You can still list and remove them.

Decide what invited people can do

Invited people run the owner's Handler. Through that Handler, they use the owner's Connections, Secrets, and Databases. Their use also counts toward the owner's time allowance. Check permissions on actions that change data, as well as on what the page displays.

Use env.WINGS_VIEWER to identify the viewer. It contains email and role: owner for the owner, or member for an invited person. The Handler cannot change this value. It is undefined in other Runs and in child Handlers.

Web App Runs do not count against the per-minute or per-hour Run limits. They do use the daily time allowance and the separate Web App access limits.

Development limits

• Each app has its own address under agi-wings.app. Its root is /.
• GET, HEAD, and POST are supported. Send POST requests from the app's own pages.
• Requests are limited to 256 KiB and responses to 1 MiB. /_wings/ is reserved for the service.
• Do not change data on GET.
• Service Workers, embedding in an iframe, and fetches from other apps are not supported.
• Responses use private, no-store so the browser does not cache them.
• Redirects must stay within the same app. Redirects to external sites are rejected.

If a Web App stops opening

Cookies saved by another app can prevent Web Apps from opening. Clearing the site data for agi-wings.app in your browser's settings may fix this.

Clearing site data also deletes localStorage. Keep data you need to retain in a Database.

Use env.WINGS_VIEWER for authentication instead of your own cookies. Another app on the same site can overwrite cookies created with JavaScript.