Host an internal tool your coworkers can sign into
Give coworkers a private tool without turning a small application into an authentication project. Tokay hosts the app and gives you coworker sign in without writing auth code, so the code can stay focused on the work the tool performs.
Last updated
AI agent? Start with llms.txt.
Protect the Services that make up the tool
You can restrict the tool after deployment without adding login routes, password storage, or session code. Paste the source or push the repository, then change the selector beside a Service URL from Public to Private.
Attach a project Group containing a company email domain or chosen visitors. Anyone outside the attached Groups sees a sign in page when they open the Private Service. Attach the same Group to related Services when they should admit the same people.
Coworkers get a simple sign in
Coworkers sign in with their work email and an emailed magic link instead of creating a separate account for the tool. You can add a logo and short message to the sign in page so coworkers know they reached the right application.
After Tokay admits a request, the app receives the visitor's verified identity and email in request headers.
Internal tool access is logged and can be revoked
The Service's attached Groups and the Project access log show who may open the tool, who signed in, and why a request was denied. The access log also records which Machines called with which credentials.
Removing a person ends active access within seconds. A whole Service or selected web paths can stay public for webhooks and callbacks, while scripts and CI use Machines scoped to the Project with independently rotatable credentials.
Your AI agent can deploy the tool without writing auth
A coding agent like Claude Code or Codex can return a private working application instead of generating security critical login code. Through Tokay's GraphQL API, it can deploy the source, make the right Services Private, attach Groups, and verify the protected URLs.
Point your agent to app.tokay.io/llms.txt for the deployment protocol.
What a VPN does not solve
A VPN protects network access but does not identify individual users inside the network. A separate identity aware proxy can provide a similar boundary, but hosting and access setup are still separate jobs. Tokay hosts the application and enforces its access policy from the same Project.
Deploy your first app on Tokay's included Small workspace without a credit card.