Access control stops visitors before your app loads. Everyone must enter a shared password or sign in with a dply account to see your app. Use it for staging apps, client reviews, and unreleased work. The gate runs at the edge, so nothing from your app, not even static files, is served to someone who hasn't passed it.
Protection modes
| Mode | Who gets in |
|---|---|
| Anyone with the link | Everyone. The default. |
| People with a password | Anyone who enters the shared password. |
| People signed in to dply | People who sign in to dply and can view this app, optionally limited to an email list. |
Important
Protection covers your production hostname and custom domains, as well as preview and per-deploy URLs. Turning it on puts your live app behind the gate too.
Turn on protection
- Open your app and choose Previews.
- Under How previews work, click the protection row, then pick Anyone with the link, People with a password or People signed in to dply.
- For a password, enter it. When changing other settings later, leave Password blank to keep the current one.
- For People signed in to dply, optionally list Only these emails. Leave the list empty to allow any signed-in user who can view the app.
- Choose Save.
The gate reaches every hostname within about a minute. Protection is set on the main app and applies to all its previews. It can't be configured on a preview by itself.
What visitors see
A visitor without access gets a Site protected page (HTTP 401) on the URL they requested:
- Password: a password field. A correct password sets a cookie and sends them to
/. - People signed in to dply: a link to sign in to dply. After signing in, dply checks that they can view the app (and that their email is on the list, if you set one), then returns them to the app.
Access lasts 24 hours per hostname. After that, visitors pass the gate again. The cookie is HttpOnly, Secure and SameSite=Lax, and it's only valid for the hostname and app it was issued for.
Who counts as able to view the app
With People signed in to dply, a user must be able to view the app in dply: a member of its organization, or someone added in the app's Members. See App members and Roles & permissions.
Only these emails narrows this further. Only listed addresses get in, even if other people can view the app in dply.
Manage protection from the API
The HTTP API exposes the current protection settings at GET /api/v1/edge/sites/{site}/access and updates them with PATCH on the same path.
Protecting a hybrid origin
Access control protects your dply hostnames. To make sure only dply can reach the origin of a hybrid app, use the origin settings on Delivery: dply sends a shared secret with each origin request, and can present a Cloudflare Access service token to an origin behind Cloudflare Access.
Limitations
- Protection applies to the whole hostname. You can't protect only some paths.
- There's no visitor sign-in through Google, GitHub or SAML. Signing in requires a dply login.
- The gate page can't be customized.