Relay links

A relay link looks like relay://<linkId>:<secret>@<relay host>. That string is the whole credential a renter receives. There is nothing else to configure on their side: they point their client at the relay host, authenticate with linkId and secret, and Proxy Bastion forwards their traffic to whichever upstream proxy the link is currently assigned to.

What the renter never sees

The renter never sees the upstream address, the upstream username, or the upstream password. Those live only on the control plane, in the proxy record you registered. The link is an opaque identifier plus a secret, not a rewritten copy of your real credentials. This is the whole point of the indirection described in What Proxy Bastion is: you can hand out access without handing out the thing that access is built on.

Bearer credential, not an identity

A relay link is a pure bearer credential. The secret in relay://<linkId>:<secret>@<relay host> is the entire proof of authorization; there is no additional binding to a person, device, or IP address. That means a forwarded link works for whoever holds it - if a renter pastes their link into a group chat, everyone in that chat can use it, and the traffic is not attributable to any one of them. The controls that limit the damage from a leaked link are expiry, a traffic cap, and revocation, covered in Limits and revocation - not per-holder identity checks, because there are none.

Why this shape

Because each person gets their own link instead of a shared upstream credential, you can expire, cap, or revoke one person’s access without touching anyone else’s, and without ever rotating the upstream password. See Security model for how that isolation is enforced end to end.