Test private previews and internal apps

Choose how the browser reaches your app

Use the same private hostname and service port that your test users rely on. Choose the access method your team supports:

• Tailscale connects hosted browsers to a restricted part of your tailnet, including local apps reachable through it.
• AWS Client VPN connects browsers to private AWS services through your configured VPN endpoint.
• Static outbound IPs support firewall allowlists when your organization has an assignment. Ask your account manager to arrange an assignment; shared outbound addresses can change.

Use the provider setup guide to restrict the connection to the hosts and ports the test needs. Network access does not replace application authentication.

Configure the Verify environment

Organization administrators configure private connections under Project → Environments → selected environment → Network Access → Private network. Follow the Tailscale or AWS Client VPN guide to create the connection and select it for the environment.

For an IP allowlist, use the assigned addresses shown in organization settings. The private network reference includes Cloudflare and Vercel firewall guidance and explains which hosted browsers use the assignment. Prepare new work after changing the assignment; existing runs keep their admitted network configuration.

Check reachability and sign-in separately

Start with a small journey that opens the application and checks an expected page. Verify private DNS, the destination port, and any firewall or deployment-protection requirements when the browser cannot reach it.

Once the page is reachable, configure a dedicated account in the project's Credentials for signed-in journeys. Follow authenticated journey testing to choose a persona and check a role-specific outcome. A successful connection alone does not verify the application behavior.

Repeat checks with the same boundaries

Keep credentials and VPN secrets in their designated secure forms. Describe permitted actions and test data in the saved Scenarios. Use a restricted connection for the environment rather than broadening network access to make a failing test pass.

When a private URL belongs to a pull request preview, carry the environment's network and credential setup into GitHub preview testing. Review recordings and assertions after each run, and use the provider guide to rotate or revoke access when it is no longer needed.