Protected scenes

Protected scenes let you control exactly who can open a scene and download its content. Lock a scene with a password for client previews or members-only content, or keep it behind your own paywall using secret access links. Either way the actual files — 3D model, panorama, map tiles and audio — are delivered through a signed, gated service, not just hidden behind a page.

The two ways to protect a scene

There are two ways to run a protected scene, and the difference is simply whether you set a password. Set one and the scene stays on your public pages for anyone to unlock; leave it empty and the scene is hidden, reachable only through a secret access link your own website hands out.

How protection works

Turning on protection does more than hide a scene from your public pages. Every piece of scene content is served through a dedicated, signed delivery service: each file URL is cryptographically signed and expires, so copying a file link out of the browser stops working within a day, and plain URLs without a valid signature simply return "forbidden".

• Protection automatically covers the whole scene, including all sub-scenes of a virtual tour — visitors always enter through the main scene.
• Scene thumbnails stay public (they appear on your board, in social-media link previews, and as the backdrop behind the password dialog), so don't put confidential information in the thumbnail view.
• Scene analytics keep working for protected scenes, anonymously as always.

Password protection

A password is the simplest way to protect a scene — no code and no integration required. It's ideal when you want to share a scene with specific people, or list it publicly but keep the content behind a gate.

Set a password

1. Open the scene in the editor and go to the Information menu.
2. Tick Protected (available on Business and Enterprise accounts).
3. Type a password in the field that appears.
4. Save.

On your board a lock badge appears on the scene tile — hover it to see which mode the scene is in. That's it: the scene is now listed on your public pages, and visitors are asked for the password before it loads.

What visitors experience

• The visitor opens the scene — from your public page, a shared link, or an embedded iframe — and sees a password dialog on the loading screen, styled with the scene's custom colours and shown in the scene's language.
• After entering the correct password, the scene loads with full functionality: points of interest, audio, virtual-tour navigation, map layers and measurements.
• The password is remembered for that browser tab only — reloading won't ask again, but a new tab or a later visit will. Nothing is stored permanently on the visitor's device and no cookies are used, so the viewer stays consent-free.
• A wrong password shows an inline error; after too many attempts in a short time the visitor is asked to wait a few minutes.

Change or remove the password

You can change the password at any time in the Information menu — the scene URL doesn't change, so existing links keep working, but anyone who doesn't know the new password is locked out (visitors mid-session may keep viewing until their tab is closed and cached links expire, within roughly a day).

Ticking Remove password switches the scene to secret-link mode: it's no longer listed on your public pages and can only be reached through an access link (see below).

Public visibility and the Private flag

The Private flag is independent of protection and keeps its usual meaning: a Private scene is not listed on your public pages, but anyone with the direct URL can reach it. You can combine Private with a password for an unlisted, password-gated scene.

As the owner you never need the password yourself: opening your own scene from the board, or while signed in, unlocks it automatically. On the public showcase page you are treated like any visitor and would enter the password there.

Secret access links (paywalls & integrations)

When you leave the password empty, the scene is protected but hidden — the only way in is a secret access link: a scene URL carrying a one-time token that your own website or a partner system generates. This is the mode to use behind a paywall or a members area, where your site decides who gets access.

How it works

Before your site displays the scene, your backend asks Kroscloud for a fresh token using your Secret Key, then adds that token to the scene URL. Kroscloud validates the token and lets the visitor in.

Set it up

1. Get your Secret Key from your account settings and store it securely in your backend. It must never be exposed to the browser.

2. In your backend, before you render the iframe (or link) to the protected scene, call the Kroscloud API at https://kroscloud.com/api/token?key={your secret key} to get a token.

3. Add the returned token to the scene's URL as the token query parameter.

Good to know

• Each token is valid for 15 minutes. Generate a fresh token every time you render a page with the protected scene, so a link a visitor copies stops working within minutes.
• Secret access links also work for password scenes, so an existing token integration keeps working if you later add a password.
• A scene in secret-link mode does not appear on your public pages, and its showcase page does not exist. Someone opening the plain scene URL sees a notice that the scene is accessible by invitation link only.

Current limitations

• Thumbnails remain public (see How protection works), so keep confidential detail out of the thumbnail view.