Who can open your app

Every web app and function is Public, Private, or Internal. Private Services admit Groups, exact-email People, company domains, and project Machines, and Tokay handles sign in before a request reaches your code.

Last updated

AI agent? Start with llms.txt.

Choose access beside the Service URL

Open the Service Access tab or use the selector beside its URL.

  • Public turns Tokay sign in off and proxies every request anonymously.
  • Private turns Tokay sign in on and admits everyone the Service allows, directly or through a Group.
  • Internal removes the public address. Only the other Services in the Project reach it, for example a backend API that only your web app calls.

A Private Service that allows nobody admits nobody. Allow a reusable Group, Person, domain, or Machine so intended callers can get in.

Each Project has a Public, Private, or Internal setting for new Services. New Projects start Public. The setting is copied when a web app or function is created. Changing it never changes an existing Service.

Tokay membership is separate. A Project member can manage an app without automatically opening it. An owner or admin can repair access but does not silently bypass it.

Allow people directly or reuse project Groups

A Service can allow exact-email People, company domains, and project Machines directly. A Group contains those same kinds and can be allowed on any number of Services in that Project. One Group membership edit then applies everywhere that Group is used. Groups do not contain Groups.

Each Group has a display name and an immutable slug. Your app receives matching slugs as trusted identity claims, so code keeps working when someone renames the Group.

There are no deny rules. A Person who still matches a Group or direct Service domain remains admitted even after their own email entry is removed.

People sign in by email

A Person who is not signed in receives an emailed magic link. There is no app password or separate Tokay account to create.

Sign in and sign out belong to the Project. Sibling Services share that sign in, and each still decides who is allowed. Signing out of the app ends browser access across the Project without signing out other Projects.

The Service's Access tab also sets the logo and short message people see on that sign in page.

Programs use Machines or OAuth

Automation that acts as itself uses a Machine identity and credential. Add the Machine directly to each intended Private Service or through a reusable Group.

A connected client acting for a Person uses Tokay Access OAuth. OAuth acts for a Person who is already allowed. It never grants access by itself.

Open a path with a public route

A Private web Service can add a public route, a specific HTTP method and path that opens without sign in. This works well for webhooks and callbacks. Every matching request is anonymous, even when it carries a Tokay credential. See Public routes.

Functions have one whole Service boundary. Use Public for anonymous providers, or keep the function Private and add controlled Machines directly or through a Group.

Changes and history stay visible

Access changes use fast Auth state and do not wait for a deploy or worker reconciliation. Active traffic refreshes promptly. During an Auth state feed outage, the standard plan may use last known authorization for up to 24 hours before failing closed.

Activity on the Service's Access tab shows admitted and denied People, OAuth clients, and Machines. Public and Private changes, Group changes, who is allowed, and public routes are recorded there too. The Workspace Access page answers the same questions across every Project under Who can go where and Who went where.