How long does a Gradio share=True link last?

It is a temporary tunnel with an expiry that has changed across Gradio versions — historically 72 hours, longer on more recent releases. Check your installed version's documentation for the current window. Two things are constant regardless of version: it dies the moment your Python process stops, and it forwards public traffic to whatever machine is running the script.

Is a Gradio share link safe?

It is an unauthenticated public URL pointed at your process. Anyone with the link can call your model, consume your API quota, and upload files to your machine within whatever your app accepts. Use the auth argument to require a username and password, do not point it at anything with credentials in scope, and never treat it as a private channel.

Are Hugging Face Spaces public?

By default yes — a Space is a public app with a public repository. Private Spaces exist on paid tiers. If your demo touches proprietary data or an unreleased model, check the visibility setting before you push, not after.

How do I share Gradio results with someone after the demo?

Publish the outputs rather than the app. Render the examples, inputs, outputs and metrics into one self-contained HTML page and put it at a stable URL with an anchored comment layer. It never expires, needs no running process, and reviewers can comment on a specific generation.

How do I keep one link across model versions?

Publish once, keep the report id, and PATCH it after each evaluation run. Revisions stack at one URL, so a stakeholder's bookmark keeps working and any two model versions can be compared.

How to share a Gradio app

demo.launch(share=True) prints a public URL and it feels like magic. It is worth understanding exactly what that URL is, because the surprise afterwards is always the same: the link stopped working, or the wrong person used it.

What share=True actually does

It opens a tunnel from a Gradio-operated relay to the Python process running on your machine. Three consequences follow directly:

It dies when your process does. Close the laptop, hit Ctrl-C, lose wifi — the link is gone. There is no cached copy of anything.
It expires on its own. The window has moved between Gradio versions — 72 hours historically, longer on recent releases — so check your installed version's docs rather than trusting a number in a blog post. It is always temporary.
It is unauthenticated by default. Anyone with the URL can call your model, burn your API quota, and upload files into your app's input path. demo.launch(auth=("user", "pass")) adds basic credentials, and that is worth doing every single time.

It is an excellent tool for its actual job: showing a colleague something on your screen for the next hour. It was never a distribution channel.

Hugging Face Spaces

The durable version. Push the app, get a persistent URL, no laptop involved. The thing to check before pushing rather than after: a Space is public by default, repository included. Private Spaces exist on paid tiers. If the demo touches an unreleased model or customer data, set visibility first.

Spaces on free hardware also sleep when idle, so the first visitor after a quiet period waits through a cold start.

Self-hosting

A container behind your own auth. Correct when the app is a real internal tool. A service to own, for what started as a notebook with a text box.

The case none of these serve

Very often the person asking for the link does not want to run the model. They want to see what it produced — the ten examples, the before-and-after, the eval scores — and say something about example seven.

For that, the app is the wrong artifact entirely. Publish the outputs.

Publishing the results instead

Run the examples once, render them into a page:

from app import predict            # your Gradio fn, reused directly

cases = ["a photo of a cat", "a diagram of a transformer", "..."]
rows = "".join(
    f"<tr><td>{c}</td><td><img src='data:image/png;base64,{b64(predict(c))}'></td></tr>"
    for c in cases
)

html = f"""<!doctype html><meta charset="utf-8">
<style>body{{font:15px/1.6 system-ui;margin:2rem auto;max-width:64rem}}
img{{max-width:320px}}td{{border:1px solid #ddd;padding:.5rem;vertical-align:top}}</style>
<h1>v0.4 sample outputs</h1><table>{rows}</table>"""

Base64 the images into the page rather than linking them. A self-contained file renders identically for every reader forever, with no host to keep alive.

Then publish and keep one id:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html samples.html \
        --arg title "Model v0.4 — sample outputs" '{title: $title, html: $html}')"

Why this is the better artifact for review

Model review is comparative and slow. Somebody looks at example seven on Tuesday, someone else disagrees on Thursday, and the model changes next week. A tunnel that expires in three days cannot hold that conversation.

A published page can. Reviewers pin anchored threads on individual outputs — "this one is the failure mode from the eval, not a regression" — and those threads persist across revisions as you PATCH new model versions to the same URL. The whole review history sits next to the evidence.

Access is a setting on the report: private, team, domain-gated or link — no public Space, no open tunnel.

And an agent attached through Comma's MCP server can read the review threads and reply on them, which is how the eval loop closes without a human transcribing feedback.

When to keep the app running

Keep it when people genuinely need to type their own input — a prompt playground, an interactive demo for a customer call. Deploy it to Spaces or your own infrastructure, put auth in front of it, and publish result snapshots alongside so the findings outlive the container.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →