Host an internal tool your coworkers can sign into
Give coworkers a private tool without turning a small application into an authentication project. Tokay hosts the app and enforces sign in before requests reach it, so the code can stay focused on the work the tool performs.
Last updated
Put access around the whole Project
You can restrict the tool after deployment without adding login routes, password storage, or session code. Paste the source or push the repository, then set the Project audience to specific people or an email domain in the Access tab.
Anyone outside that audience sees a sign in page. Related Services in the same Project use the same access boundary, so a suite of internal tools does not need a separate login for each one.
Coworkers get a simple sign in
Opening the tool takes a work email and a magic link rather than a new account or IT setup. You can add a logo and short message to the sign in page so coworkers know they reached the right application.
The app receives verified identity headers after Tokay has allowed the request.
Access stays visible and revocable
Tokay gives you a direct answer to who can reach the tool and who has used it, reducing the security work around an internal app. The access log records who signed in, which requests were denied, and which machine tokens called.
Removing a person ends active access within seconds. Paths that need to stay public, such as a webhook endpoint, can be declared explicitly, while scripts and CI use scoped machine tokens.
Your AI agent can deploy the tool without writing auth
A coding agent like Claude Code or Codex can return a private working application instead of generating security critical login code. Through Tokay's GraphQL API, it can submit the source, deploy the Services, restrict the audience to the chosen people or domain, and verify the protected URL.
Point your agent to app.tokay.io/llms.txt for the deployment protocol.
Know the tradeoff
A VPN protects network access but does not identify individual users inside the network. A separate identity aware proxy can provide a similar boundary, but hosting and access setup are still separate jobs. Tokay combines the application host and the door in one Project.
Tokay has a very generous free tier with no credit card. Get started.