Examples by Protocol

Use bsh for the supported provisioning methods below. The examples pair a checkout script with a checkin script so target access is removed when the grant ends. For fields used by custom integrations, see the Payload reference.

Configure bsh once per permission

Use the latest bsh on every broker that can run the permission. Keep bsh up to date when updating Bridge.

Configure the following permission variables for both checkout and checkin:

Variable	Value
`BSH_USER_EMAIL`	The requesting user’s `user.username`.
`BSH_TRANSACTION_ID`	The platform’s `profile.transactionId`, unchanged at checkin.
`BSH_BRIDGE_URL`	The public HTTPS origin, such as `https://bridge.example.com`.
`BSH_SESSION_DURATION`	The permitted lifetime, such as `1h`.
`BSH_BRIDGE_USERNAME`	The user’s configured Bridge login, if it differs from `BSH_USER_EMAIL`.
`BSH_NATIVE_AUTH`	`bridge_credentials` for the examples on these pages.
`BSH_BRIDGE_AUTH_PASSWORD`	The user’s separate Bridge password, when supplied by the platform. Otherwise bsh generates one and returns it with the connection details.

The colocated broker inherits BRIDGE_BROKER_API_URL and BRIDGE_BROKER_API_TOKEN_FILE from Bridge. For a broker on another host, follow Connect an external broker. Target administration uses separate credentials, specified on each example page.

The text blocks on these pages list permission variable values. Supply secrets through protected files or value references. Replace example hostnames, accounts, and paths with your deployment’s values. Keep the same target and identity settings for checkout and checkin.

See Configure a permission for Bridge for the complete setup. bsh probe lists available methods. A protocol-specific probe checks configuration without provisioning access:

bsh probe ssh --method existing-user-key --mode bridge

Use the API for unsupported operations

For provisioning methods that bsh does not provide, use a custom script and the checkout API. bsh does not submit arbitrary JSON or list and inspect existing checkouts.

Keep the colocated broker API on loopback port 8081. External clients use HTTPS with an enabled checkout API token. Existing shell integrations are covered by the legacy API helper reference.

For raw JSON examples, replace the placeholder expires_at with a future Unix timestamp. bsh examples calculate expiry from BSH_SESSION_DURATION.

How users connect

Creating the checkout is the same for every protocol; how the user reaches the target depends on the modes you’ve enabled (see the Protocol Reference).

Native - the user points the client they already use at the Bridge’s port for that protocol, authenticating as <britive-user>%<target-host>. The picker shows the exact address, username, and a ready-to-run command for each checkout - for example:
terminal - representative native SSH connect
```
ssh -p 22 'alice@corp%10.0.4.21'@bridge.example.com
```
Browser - the user clicks Connect in the picker, or opens https://bridge.example.com/connect?transaction_id=<transaction_id>; a recorded session opens in a new tab with nothing to install.