Host an internal tool your coworkers can sign into
Give coworkers a private tool without turning a small application into an authentication project. Tokay hosts the app and gives you coworker sign in without writing auth code, so the code can stay focused on the work the tool performs.
Last updated
AI agent? Start with llms.txt.
Protect the Services that make up the tool
You can restrict the tool after deployment without adding login routes, password storage, or session code. Paste the source or push the repository, then open the Project's Access tab, make the Project Private, and choose which Services should require access.
The shared audience can include Project members, a company email domain, or chosen visitors. Anyone outside that audience sees a sign in page when they open a restricted Service. Related restricted Services use the same access boundary, so a suite of internal tools does not need a separate login for each one.
Coworkers get a simple sign in
Coworkers sign in with their work email and an emailed magic link instead of creating a separate account for the tool. You can add a logo and short message to the sign in page so coworkers know they reached the right application.
After Tokay admits a request, the app receives the visitor's verified identity and email in request headers.
Internal tool access is logged and can be revoked
The Project's audience and access log show who may open the tool, who signed in, and why a request was denied. The access log also records which Machines called with which credentials.
Removing a person ends active access within seconds. A whole Service or selected web paths can stay public for webhooks and callbacks, while scripts and CI use Machines scoped to the Project with independently rotatable credentials.
Your AI agent can deploy the tool without writing auth
A coding agent like Claude Code or Codex can return a private working application instead of generating security critical login code. Through Tokay's GraphQL API, it can deploy the source, protect the right Services in a Private Project, set the shared audience, and verify the protected URLs.
Point your agent to app.tokay.io/llms.txt for the deployment protocol.
What a VPN does not solve
A VPN protects network access but does not identify individual users inside the network. A separate identity aware proxy can provide a similar boundary, but hosting and access setup are still separate jobs. Tokay hosts the application and enforces its access policy from the same Project.
Deploy your first app on Tokay's permanent free plan without a credit card.