Documentation
Access
Who can open an app is a setting, not something you build. It is enforced in front of your app, so software with no login of its own can still be shared with exactly three people.
The three levels
Each level gets its own sentence rather than a single reassurance, because the three are genuinely different and one of them is not private at all:
| Level | Who can open it |
|---|---|
| Private | Only you. Everyone else meets a sign-in wall. |
| Workspace | Everyone in the app's workspace, plus anyone you invite by email. |
| Anyone with the link | No sign-in at all — and the URL is guessable from the app's name, so treat this as published rather than as unlisted. |
You pick a level when you create the app and can change it afterwards. Changing it takes effect on the next request; there is nothing to redeploy.
Sign-in happens before your code runs
This is the part worth understanding, because it changes what you have to build. A visitor to a private or workspace-level app is authenticated in front of the app — if they are not allowed in, your services never see the request at all.
So an internal tool with no user model, a prototype with no login screen, a dashboard you have not got round to securing: all of them can be shared safely with named colleagues, today, without writing an authentication layer first. You are not relying on an unguessable URL, and you are not putting something unfinished on the open internet.
Inviting people
At workspace level you can invite people by email address. Everyone in the workspace already has access; invitations are for the people who are not in it.
One sign-in covers every app
Signing in is not per app. Once you are signed in you can open every app you have access to, and opening a second one does not disturb the first — no repeated emails, no being asked again for something you have already proved.
Removing access
Removing someone takes effect on their next request. There is no session that keeps working until it expires, and nothing to restart — which is what makes sharing something reversible rather than a decision you cannot walk back.
- Removing an invitation removes that person's access.
- Moving an app to Private closes it to everyone but you, invitations included.
Access follows the app, not its address. Adding a custom domain does not open an app up — the same rules apply on every hostname it answers.