# How to Program Expiring Share Links in Devin AI via Fast.io

Devin AI secure sharing with expiring links protects temporary development outputs. Connecting Devin AI to Fast.io workspaces allows developers to programmatically generate secure, expiring share links. This guide details how to configure these auto-revoking links via Python scripts and the Model Context Protocol.

Source: https://fast.io/resources/devin-ai-secure-sharing-expiring-links/
Author: [Derek Labian](https://fast.io/authors/derek-labian/)
Last reviewed: 2026-08-20

## How to Bridge Ephemeral Sandboxes with External Storage

Two coding agents pointed at the same repository will happily overwrite each other's work, and neither will notice. The fix is not a smarter agent, it is a shared place to put work where the second one can see what the first one did.

When an autonomous agent like Devin AI executes software engineering runs, it operates inside an isolated cloud virtual machine sandbox. While this isolation protects the host environment, it introduces a challenge. The sandbox virtual machine is ephemeral. When a task completes, the container shuts down and all local files are destroyed. For source code, the solution is committing code and pushing it to a remote Git repository. However, software tasks often generate non-code assets such as database dumps, test logs, PDF documentation, and media assets that cannot be committed to Git without bloating the repository.

To distribute these non-code assets to human team members, the agent needs an external sharing mechanism. Storing files in basic object storage or general file sync platforms lacks central access controls, version tracking, and programmatic link deactivation. Programmatically distributing those files through [Fast.io workspaces](/product/workspaces/) provides the necessary infrastructure. Secure sharing with expiring links lets agents programmatically distribute files with access limits that automatically revoke after a defined window. Fast.io provides File Shares for single files. For production developer pipelines, teams use the Fast.io API to generate durable, auto-expiring shares.

By programming these links to deactivate on a schedule, teams eliminate the risk of stale credentials. An open link left in a public channel or shared via email represents a permanent security exposure. Automatically revoking access when a task window closes protects sensitive development outputs and reduces the risk of accidental data exposure.

When Devin AI runs custom scripts, it can interact with external HTTP endpoints using personal access tokens or service user API keys. This capability allows the agent to upload output files directly to Fast.io workspaces and configure security settings without human intervention. The agent can write a file, trigger the share creation, and hand a self-destructing link to a human teammate. This automated workflow keeps files secure and ensures that external partners only see what they need, for as long as they need it.

## How to Authenticate Devin AI and Fast.io API Sessions

Programmatic integration requires setting up secure credentials on both platforms. Devin AI uses a token-based authentication model to govern API access. Developers can configure two types of credentials depending on the integration context. For human-driven scripts and local testing, Personal Access Tokens are managed from the settings page. For automated pipelines, developers configure Service Users. Service users are non-human accounts designed for API integrations, allowing teams to assign specific roles and maintain a distinct audit trail.

All Devin API keys start with the cog_ prefix and are displayed only once upon creation. If a key is lost, a new one must be generated. In your automated scripts, the Devin token is passed in the Authorization header of the request:

```bash
curl -X GET "https://api.devin.ai/v3/organizations/YOUR_ORG_ID/sessions" \
  -H "Authorization: Bearer cog_your_service_token_here"
```

On the storage side, authenticating with Fast.io requires a scoped API key. Developers can generate these keys in settings under devices and agents. Every request to the Fast.io REST API requires passing the token in the Authorization header against the current namespace:

```bash
curl -X GET "https://api.fast.io/current/user/" \
  -H "Authorization: Bearer YOUR_FASTIO_API_KEY"
```

Creating a user account is free, but doing real work requires an organization on a paid subscription. Every organization starts with a 14-day free trial, which requires a credit card. Fast.io plans are Starter at $9.99/mo, Business at $49.99/mo, and Enterprise at $199.99/mo. Under the standard agent workflow, Devin AI can sign up for a free user account, build a workspace, and then initiate an ownership transfer link. A human developer then clicks the link, connects the workspace to a paid organization, and begins the 14-day free trial. This process is detailed on the [Fast.io pricing page](/pricing/).

To protect these tokens, developers must inject them into Devin's VM environment as environment variables rather than writing them directly into script files. Hardcoding credentials in code repos represents a significant risk. If the repository is exposed, the API keys could be leaked. Devin supports environment variable injects at session startup, ensuring that credentials like the Fast.io API key are kept in memory and are never written to the VM's disk.

## How to Program Devin AI Secure Sharing with Expiring Links

To automate sharing, Devin AI can run a script that uploads a file to Fast.io and generates a time-limited link. Since there is no official Fast.io SDK, Devin executes standard HTTP requests using the requests library in Python.

Here is a Python script that uploads a report and generates a branded portal share that automatically expires in 24 hours:

```python
import os
import datetime
import requests

FASTIO_API_KEY = os.getenv("FASTIO_API_KEY")
WORKSPACE_ID = os.getenv("FASTIO_WORKSPACE_ID")

if not FASTIO_API_KEY or not WORKSPACE_ID:
    raise ValueError("Missing Fast.io API credentials in environment")

file_path = "/workspace/reports/build_log.pdf"
upload_url = "https://api.fast.io/current/upload/"

headers = {
    "Authorization": f"Bearer {FASTIO_API_KEY}"
}

with open(file_path, "rb") as f:
    files = {"file": f}
    upload_response = requests.post(upload_url, headers=headers, files=files)

if upload_response.status_code != 201:
    raise RuntimeError(f"Upload failed: {upload_response.text}")

file_data = upload_response.json()
file_id = file_data.get("new_file_id")
print(f"File uploaded successfully. File ID: {file_id}")

expiry_time = datetime.datetime.utcnow() + datetime.timedelta(hours=24)
expiry_str = expiry_time.strftime("%Y-%m-%d %H:%M:%S")

share_url = f"https://api.fast.io/current/workspace/{WORKSPACE_ID}/create/share/"
share_headers = {
    "Authorization": f"Bearer {FASTIO_API_KEY}",
    "Content-Type": "application/x-www-form-urlencoded"
}

share_data = {
    "expires": expiry_str,
    "share_type": "send",
    "node_id": file_id
}

share_response = requests.post(share_url, headers=share_headers, data=share_data)

if share_response.status_code == 429:
    retry_after = share_response.headers.get("x-ve-limit-expires")
    print(f"Rate limit exceeded. Retry after: {retry_after}")
elif share_response.status_code != 200:
    print(f"Failed to create share: {share_response.text}")
else:
    share_info = share_response.json()
    share_link = share_info.get("share_url")
    print(f"Expiring share link generated: {share_link}")
```

This script follows a simple three-step process:
First, the file is uploaded. Fast.io processes the file upload and returns a JSON payload containing the new file identifier under the key new_file_id.
Second, the script calculates the expiration time. The timestamp format must match YYYY-MM-DD HH:MM:SS. If the format is incorrect, the server will return an error code 1605 indicating invalid input.
Third, the script posts to the share creation endpoint. The share_type is set to send, and the expires field carries the calculated timestamp.

If the request is successful, the server returns a share_url that can be sent to customers or clients. If the agent hits rate limits, the API returns HTTP 429 with error code 1671. The script detects this condition, reads the x-ve-limit-expires header, and can be programmed to pause execution until the limit resets. This defensive programming ensures that automated scripts run reliably without causing cascading API failures.

## How to Configure the Remote Model Context Protocol Server

While custom scripts work well, developers can also integrate Fast.io directly into Devin's toolset using the Model Context Protocol. Fast.io publishes a remote Model Context Protocol server. This server is not an npm package, meaning there is no local command or npx execution step to start it. Instead, it is hosted as a web service over Streamable HTTP and legacy SSE, as described in the [Fast.io MCP server guide](/storage-for-agents/).

To connect Devin AI to the Fast.io MCP server, developers configure the connection parameters inside Devin's configuration directory. Devin looks for tools in project-specific or user-global configurations. To add the remote server, edit the .devin/mcp_config.local.json file to include the URL and the Bearer token headers:

```json
{
  "mcpServers": {
    "fastio": {
      "url": "https://mcp.fast.io/mcp/code",
      "headers": {
        "Authorization": "Bearer YOUR_FASTIO_API_KEY"
      }
    }
  }
}
```

Alternatively, developers can use the Devin CLI to configure the server from the command line. To register the Fast.io server, execute the add command:

```bash
devin mcp add fastio https://mcp.fast.io/mcp/code
```

When registering the server, choosing the right scope is critical. Storing configuration details in the local scope prevents credentials from being committed to Git, while the project scope allows the entire team to share the tool definition.

Once configured, the Fast.io MCP server exposes a consolidated MCP toolset to Devin AI. The agent can invoke these tools to list files, upload data, and create file shares without needing custom Python scripts. For example, instead of writing request loops, Devin can call the create_fileshare tool directly. This simplifies the development workflow, making it easier for the agent to manage assets and distribute results securely.

The MCP server connects Devin's cognitive engine to your shared storage space. The agent does not need to learn custom endpoints. It queries the server's schema to discover available operations. When Devin needs to write to a workspace, it calls the write_file tool. When it needs to share that file, it calls the create_share tool, passing the expires timestamp in the arguments. This protocol-based access ensures that security boundaries are maintained, as Devin only interacts with Fast.io through the scopes allowed by the API key.

## How to Manage Activity Feeds and Transfer Ownership

Automated link generation is only the first part of the sharing lifecycle. To maintain visibility, developers must track when and how shared documents are accessed. Fast.io supports this by providing detailed activity logging and collaboration capabilities within the workspace.

Instead of polling individual files, Devin AI can subscribe to the workspace activity feed. The agent can monitor access events by calling the events search endpoint:

```bash
curl -X GET "https://api.fast.io/current/events/search/?workspace_id=ws_your_workspace_id" \
  -H "Authorization: Bearer YOUR_FASTIO_API_KEY"
```

If Devin needs to react to events in real time without continuous polling, it can use the workspace activity long-poll endpoint. By sending a request to GET /current/activity/poll/{entity_id}?wait=95&lastactivity={timestamp}, the agent can pause until an activity occurs. This allows the agent to detect when a client has downloaded a shared file and immediately trigger the next step in its development run.

To further secure and organize the workspace, Fast.io includes several built-in features that assist human-agent collaboration:

- Per-file version history: If Devin uploads an updated version of a report, Fast.io preserves all previous versions, allowing human developers to audit changes or restore prior revisions.

- Intelligence Mode: Once enabled, files uploaded to the workspace are indexed automatically. Humans can query the workspace using hybrid search, which combines exact full-text matching with semantic meaning, returning answers with citations to the files, as explained on the [Fast.io workspace intelligence page](/product/ai/).

- Collaborative Notes: Real-time notes allow human developers and agents to edit project documentation simultaneously, with cursors visible to all participants.

- Metadata Views: Turn files into a live, queryable database. By visiting the [Metadata Views page](/product/document-data-extraction/), developers can specify the fields they want extracted, and the system populates a spreadsheet with types like text, decimal, URL, and date.

When Devin completes its setup tasks, it can transfer ownership of the organization to a human manager. The agent generates an ownership transfer link, allowing the human to claim the organization and start their 14-day free trial. The agent retains administrative access, allowing it to continue running background sessions while the human manages the billing and team permissions.

This combination of audit logging and ownership management ensures that security is maintained throughout the lifecycle of the shared assets. Since every action is logged in an append-only audit trail, administrators can verify which files Devin shared, which links were generated, and when those links expired. This level of tracking is essential for organizations that require visibility into automated workflows and must verify that their data boundaries remain secure.

## Frequently asked questions

### How do I generate an expiring share link?

You can generate an expiring share link by making a POST request to the Fast.io API endpoint at POST /current/workspace/{workspace_id}/create/share/ and passing the expires parameter formatted as YYYY-MM-DD HH:MM:SS in the request body. Once the expiration time is reached, access to the shared files is automatically revoked.

### Can AI agents manage document sharing permissions?

Yes, AI agents like Devin can manage sharing permissions programmatically by using the Fast.io API or connecting to the Fast.io MCP server. The agent can configure file access tiers, assign permissions to specific organization members, and set auto-expiring links for secure client handoffs.

### What happens when a shared link expires?

Once the expires timestamp is reached, the share portal becomes inactive and access is revoked. The underlying files remain secure inside the Fast.io workspace, but the public URL is no longer valid, preventing any further downloads or views.

## Sources

- [Devin API Documentation](https://docs.devin.ai/api-reference/authentication): Devin API keys for service users start with the cog_ prefix and are managed in settings under service users.

## About Fast.io

Fast.io provides shared workspaces where people and AI agents work on the same files, with built-in semantic search and citation-backed chat over what they hold. Agents reach it through a remote MCP server, a REST API at https://api.fast.io/current/, and a command line client published on npm as @vividengine/fastio-cli. MCP setup is at https://mcp.fast.io/docs: Claude and most MCP clients connect to https://mcp.fast.io/mcp/tools, ChatGPT to https://mcp.fast.io/mcp/operations, and coding agents to https://mcp.fast.io/mcp/code.