Cross-project private access

Private networking lets services reach each other inside one environment. Services in a different project are blocked by default, even in the same workspace.

Sometimes you do want that: one shared database serving two products, an internal API that several teams' projects call, a queue that producers in one project write to and consumers in another read.

Rather than making the service public and locking it down again, grant the other project private access to a single port.

Granting access

1. Open the service panel → Settings tab → Networking. Under Private Networking you will see the line "Allow selected projects in this workspace to connect on a specific private port."
2. Pick the consumer project — the project that should be allowed to connect.
3. Choose the protocol, TCP or UDP.
4. Enter the port to open.
5. Click the + button.

The grant takes effect on the private network. Nothing is exposed to the internet, and traffic is not billed as egress.

You can only choose projects in the same workspace, and not the project the service already lives in.

What a grant covers

A grant is for one project, one protocol, and one port. To open a second port, or to allow a second project, add another grant.

Everything else stays closed. A project with a grant on port 5432 cannot reach any other port on the service, and cannot reach any other service in your project.

Connecting from the other project

Use the service's private hostname, shown in the service panel, on the granted port. The consuming service connects the same way it would to a service in its own environment.

Revoking access

Click the trash icon on the grant. Connections from that project stop immediately.