# Node internal visitor registration

A visitor desk gives staff a private arrival list while guests use one public form to register their name, host, and arrival time. Tokay runs both views as one Web Service and opens only the exact guest path.

Use this shape when most of an internal app should require sign in but one narrow action belongs to the public. Your server keeps its normal routes while Tokay enforces the boundary before requests arrive.

## Facts

- Runtime: Node.js
- Framework: Express
- Service types: Web Service
- Resources: SQLite
- Required secrets: None

## What it does

The private dashboard shows today's expected visitors as cards and keeps the full registration history in a table.

At `/submit`, a guest enters their name, who they are meeting, and a time within the next 180 days. The confirmation page repeats the accepted visit details.

Every public submission appears on the staff page with **Guest link** as its source. A visitor cannot use the form to claim a private source such as **Host added**.

## Deploy it

Bring this folder to Tokay any way you like. Paste or upload it in the dashboard, push it with git, or hand it to your AI agent along with [our agent instructions](https://app.tokay.io/llms.txt). Tokay figures out the rest.

Working in Claude, ChatGPT, VS Code, or another MCP client? Connect the [Tokay MCP server](https://tokay.io/docs/platform-mcp) and ask your agent to deploy this example. It signs in through your browser, so there is no token to paste.

New to Tokay? The [getting started guide](https://tokay.io/getting-started) walks you through your first deploy.

## Keep the staff pages private

1. From the Project, open **App audience**.
2. Change **Audience** to **Specific people**. Leave **Project members** selected.
3. Choose **Save audience**. Review **Restrict who can visit** and choose **Save**.
4. Under **Public endpoints**, choose **Add endpoint**.
5. In **Service**, choose the visitor registration Web Service.
6. In **Path**, enter `/submit`, then choose **Add**.

Use the exact path `/submit`. The rule `/submit/*` covers paths below it but does not include the form itself.

## Try it

1. Open the root in a signed out browser and confirm Tokay asks you to sign in. Then open `/submit` without signing in.
2. Register a visit and check the confirmation page.
3. Sign in to the root, find the **Guest link** entry, then deploy again. The registration remains in the staff history.

The public rule covers every HTTP method on `/submit`, so the app still checks which methods are allowed. `GET` shows the form, `POST` saves it, and every other method returns `405`.

## How it works

You can safely expose the form because the server validates every field, limits dates, and assigns **Guest link** itself. The public request cannot choose another source.

SQLite keeps the history through deployments and restarts. A few fictional visits appear only when the database is empty. Read [Files and persistent storage](https://tokay.io/docs/persistent-storage) to see how Tokay protects the file.

Tokay checks the audience before a request reaches Express. The public endpoint covers only `/submit`, while `/`, `/health`, and every other path remain private.

## Secrets

There are no application secrets. Project access and the public endpoint are Tokay settings.

## Grow from here

Try the [private Streamlit support dashboard](/examples/python-streamlit-support-dashboard) when coworkers need filters, charts, and editable notes.

## Source files

- [package.json](https://tokay.io/examples/src/node-internal-visitor-registration/package.json)
- [src/server.ts](https://tokay.io/examples/src/node-internal-visitor-registration/src/server.ts)
- [tsconfig.json](https://tokay.io/examples/src/node-internal-visitor-registration/tsconfig.json)

## Download and source

- [Download the complete project](https://tokay.io/examples/downloads/node-internal-visitor-registration.zip)
- Last updated: 2026-07-31
- Example revision: `52c7b7f`
- [View this revision on GitHub](https://github.com/tokayio/tokay-examples/tree/52c7b7ffd52e157375b08f1f11ff4fbe6c498642/node-internal-visitor-registration)
- [Host an internal tool your coworkers can sign into](https://tokay.io/use-cases/host-internal-tool)