Draft and live app URLs are easy to share — and easy to open by anyone who has the link. Password protection puts a gate in front of your app so visitors must enter a site password before anything loads. Use it when you want a private preview, a limited rollout, or a simple lock on a live site without building full in-app authentication.
What password protection does
Password protection is a site-level lock on your app's frontend URL. It is separate from Internet Identity login, user roles, and user approval inside the app.
When protection is on:
- Anyone who opens the URL without the password sees a private gate that says the app is private and asks for the site password.
- Links you copy from Caffeine — share links, Open live app / Open draft from chat, and domain links in project settings — include the password automatically, so you and collaborators can open the app without typing it each time.
- Visitors who only have the bare URL (without the password embedded) must type the password manually.
You choose what is protected:
- Disabled — anyone with the URL can open the app.
- Draft — only the draft URL is locked. The live app stays publicly open.
- Live + Draft — both the draft and live URLs are locked. This option is available once your project has a live app.
How to turn it on or change it
- Open your project.
- Open project settings (gear icon).
- Open More → Password protect. If protection is already on, the menu item shows as Password protect (on).
- Choose a mode: Disabled, Draft, or Live + Draft.
- If you enable protection, enter a password (at least 6 characters, up to 128).
- Click Save.
To remove protection, set the mode to Disabled and save. You do not need to clear the password field first.
If the settings screen says password protection is not available right now, try again later — Caffeine may still be preparing the live frontend for protection.
Sharing a protected app
When protection is on, use Caffeine's own share and open actions whenever you can:
- Live → Copy app link or Open live app
- Project settings → More → Copy share link
- Opening draft or live from chat messages
- Domain links listed in project settings
Those links carry the site password for you. If you paste only the plain hostname to someone else, they will hit the password gate and need the password from you.
Custom domains follow the same rule: if the live URL is protected, opening the domain from project settings uses a protected link. Someone who types the custom domain by hand still needs the password unless they already unlocked the site in that browser.
What stays protected after builds and restores
Password protection is a project setting, not something the AI rebuilds into your app code. It stays in place across normal AI builds, wake-ups, redeploys, and draft reverts. You only change it from Password protect in project settings.
Password protection vs in-app access control
| Goal | Use |
|---|---|
| Stop strangers from opening the URL at all | Password protection |
| Let people open the app, then approve who can use it | User approval |
| Different permissions after login (admin vs user) | Roles |
You can combine them. For example, lock the draft with a password while collaborators test, keep the live site open, and still use roles or approval inside the live app.
Frequently asked questions
Where do I find Password protect?
Project settings (gear icon) → More → Password protect. The item appears when a draft URL exists for the project.
What do visitors see if they do not have the password?
A private gate titled This app is private, asking them to get the site password from the app creator and enter it before continuing.
Do share links expose the password in the URL?
Protected links include a short token in the link so browsers can unlock the site for people you share with. Treat those links like the password: do not post them publicly if you want the site to stay private. Anyone with a protected link can open the app without typing the password.
Can I protect only the draft?
Yes. Choose Draft. Your live app remains open to anyone with the live URL.
Can I protect the live app too?
Yes. Choose Live + Draft to lock both the draft and live URLs with the same password. That option appears once your project has a live app.
Does this replace Internet Identity login in my app?
No. Password protection only gates whether the site can load. Once someone is through the gate, your app's own login and roles still apply as you built them.
Will going live or reverting remove the password?
No. Protection is reapplied when draft or live frontends are woken, redeployed, or restored. Change or remove it only from Password protect in project settings.
Is password protection available on all plans?
Yes. Password protection is available to all users at no extra charge. If you do not see Password protect under More, make sure your project has a draft URL — the option only appears once a draft exists.
Will password protection stop search engines from indexing my app?
Yes, if the live URL is protected. Crawlers see the password gate instead of your pages. Leave live protection off if you want the public live app in search results. See How Search Engines See Your App.