Access

Two settings decide who reaches a tool: the service's visibility, which accounts may find it, and the tool's access, which kinds of caller it takes.

Visibility

crab visibility notes
crab visibility notes public

• A service is private unless its project declares public = true in crab.toml. Only its own account, that account's members and keys made on it see or call it; to anyone else it does not exist.
• crab visibility <service> public, or Visibility in its settings, makes it public: anyone can read its page, and any signed-in account can call the tools its access opens to them. private makes it private again, and calls from outside the account fail from the next one. Only owners of the account change it.

template = true independently publishes image documentation and allows others to deploy their own copy. It does not grant calls to your instance.

Access

[tools.forecast]
access = "public"

Each tool's table under [tools] in crab.toml may set access. It names the kinds of caller the tool takes:

• From outside: a signed-in caller — a person with crab call or MCP, an API key, or a web page through an app, for a user signed in to its site. The service's visibility decides which accounts these may be.
• With no caller: a page through an app that admits visitors who are not signed in.
• From another service: a service calling a deployment by owner/service, subject to its visibility and tool access, through berm_lang::call. See From another service.

• None, internal. A tool that sets no access takes no calls at all. It runs only as the service's own crons, wakes and Stripe events. A cron tool is always internal: giving it access is refused.
• public. Every caller but one with none. The usual choice for a tool others call.
• anonymous. Everything public takes, and calls with no caller as well: the only access a visitor who is not signed in reaches, as a page counting its visits does.
• accounts. Restricted to callers from outside. Other services of the account are refused.
• services. Restricted to the account's other services. Every call from outside is refused, the owners' included.

Rules

• access applies to the service's owners too: a tool with none is not called from outside even by them.
• Only a tool with access can set a price or a catalog job; on an internal tool both are refused.
• Making a tool internal, taking fewer kinds of caller, or no longer taking calls with no caller breaks its callers: a deploy that breaks what a caller used in the last 30 days is refused unless forced. See Deploying.