LayerV vs Tailscale
Share the App. Skip Network Enrollment.
To share a machine with someone outside your tailnet, Tailscale sends an invite they accept with their own Tailscale account, and they reach the machine from a Tailscale client; Funnel instead makes a port public. LayerV shares one app without either: the recipient opens an access link in a browser, and the link expires and can be limited to a set number of uses.
Facts checked October 7, 2026 against each vendor’s documentation.
Tailscale connects your devices into a private network. Sharing one app with someone outside that network is where the two approaches split: Tailscale brings the person to the network, and LayerV brings a link for one resource to the person.
Share one app from the command line
qurl publish http://127.0.0.1:3000
qurl share <CRID>Architectural Difference
Inside a tailnet, grants control which hosts, ports, protocols, and application capabilities each device can use, and subnet routers extend the tailnet to devices that do not run the Tailscale client. To give someone outside the tailnet one machine, you share it: they accept the invite with their own Tailscale account and reach the machine from their Tailscale client, and the shared machine is quarantined so it cannot start connections to them. Funnel is the other way out, and it makes the port public on the internet.
Publish an HTTP resource with LayerV and issue an access link for the person or agent who needs it. Browser recipients need no LayerV account or installed client. Developers can issue and open links in code, making private resource access part of an application workflow. Set an access window, keep the origin private behind the connector, and revoke the link when the task ends.
A Cryptographic Resource ID (CRID) gives the resource a cryptographic identity independent of its network address. Who can open the resource is a separate choice, made when it is published. A private resource opens only for its publisher’s devices and for the people and devices the publisher allowed, so the CRID of a private resource is safe to send to anyone. A public resource can be opened by anyone who has its CRID. A qURL carries a separate, signed grant for that resource; a compatible opener verifies it before requesting access. LayerV checks authorization before opening the protected origin connection.
Feature Comparison
| Feature | LayerV | Tailscale |
|---|---|---|
| Recipient setup | A browser for HTTP resources; the SDK for programmatic access | Their own Tailscale account and client to accept a shared machine; Funnel needs neither but is public |
| What a grant reaches | One published resource per access link | A shared machine, further limited by grants to hosts, ports, and protocols |
| Lifetime and single use | Set on each link: expiry and use limit | Lasts until you remove the share or change grants |
| Revoking one recipient | Revoke that link through the API; other links keep working | Remove their share, or change grants |
| Origin connection | Outbound connector; no inbound port | Devices join the tailnet; a shared machine is reached over it |
| Identity sent to the app | None; keep your app’s own sign-in | Tailscale Serve adds headers such as Tailscale-User-Login for tailnet users |
| Protocols | HTTP apps and APIs | Any TCP or UDP traffic the grants allow, including SSH |
Which one to use
Choose LayerV to
Share a private preview with a customer, give a contractor temporary access to a dashboard, or let an agent reach a private API. LayerV gives each task a resource-scoped access link, with no network enrollment for browser recipients and developer tools for automating the same workflow.
When Tailscale is the better choice
Choose Tailscale when the people who need the app are already in your tailnet, or will be for a while: they get the app and whatever else your grants allow, and Tailscale Serve passes their identity to the app. It also carries non-HTTP traffic such as SSH and databases, which LayerV access links do not.
Frequently Asked Questions
Does the recipient need a client or account?
For a published web app, the recipient opens the access link in a browser without a LayerV account or CLI. The app’s own login still applies if you keep it enabled.
Can I share a Tailscale machine with someone outside my tailnet?
Yes. Tailscale sends them an invite to one machine, which they accept with their own Tailscale account and reach from their Tailscale client; the machine is quarantined so it cannot start connections to them. With LayerV, they open a link in a browser instead.
Can I keep using Tailscale internally?
Yes. You can keep private network connectivity for internal operations and use LayerV links to share selected apps with people or agents. Configure each resource so its intended access paths and application permissions remain clear.
Does an access link expose the surrounding network?
A LayerV access link is scoped to one published resource. It gives the recipient a path to that app or API, without providing a general network route.