Choose who can open your app
Make an app private in one click, and only the people you allow can open it. Roar AI runs the sign-in in front of the app, so its code does not change.
Who you can let in
Use any mix of the three, and change the list at any time.
Your organisation
Everyone who is a member of your company in Roar AI.
Named people
Add email addresses one at a time, including people outside your company.
A company domain
Anyone with an address at your domain. Public mail domains such as gmail.com are refused.
Three steps, all in the console
You set it up in the console, without changing your app or installing anything.
Turn on private access
In your app’s settings, open Access and choose “Only people I choose”.
Choose who can open it
Allow your organisation, a company domain or named email addresses.
Share the link
People sign in with their email and a six-digit code, then land on the page they asked for.
What Roar AI takes care of
A login you build yourself has to send codes, keep sessions and end them when someone leaves. Roar AI does this in front of the app instead, the same way for every app you host.
See everything included with app hostingNo login to build
Roar AI runs the sign-in page and checks every visit, so your app’s code stays as it is.
Removing access ends it
Take a person or a domain off the list and their access ends. An earlier sign-in does not let them back in.
Webhooks and forms keep working
List the paths other services call and they stay open. For n8n it is one click.
Your own domain is covered
Every address the app answers on is private, your own domain as well as ours.
Scheduled jobs keep running
Jobs you schedule in Roar AI still reach the app without signing in.
Questions about private apps
What does making an app private do?
Only the people you choose can open it. Anyone else who has the link sees a Roar AI sign-in page, and if their email is not on your list they cannot get in.
Do visitors need a Roar AI account?
No. A visitor enters their email, types the six-digit code Roar AI sends them, and lands on the page they asked for. They do not get an account and cannot reach your console.
Do I need to change my app?
No. Roar AI checks each visit before it reaches your app. If your app wants to know who is signed in, Roar AI passes the address in the X-Roar-User-Email header while the app is private.
Can I allow everyone with a gmail.com address?
No. A domain rule only accepts a company domain, because anyone can create an address at a public mail service. Add people with personal addresses one at a time instead.
What happens to webhooks, forms and scheduled jobs?
Scheduled jobs keep running. Services that call your app, such as payment callbacks or n8n webhooks, cannot sign in, so list the paths they use and those stay open while the rest of the app stays private.
Is anything still public?
Built files such as scripts, styles and images under /static, /assets, /build and /_app are served without sign-in so pages load quickly. Keep private files out of those folders.
How long do people stay signed in?
A sign-in lasts twelve hours, then Roar AI asks again. Someone you have removed cannot use an earlier sign-in.
Make your first app private
Create a free account and deploy your app, then turn on private access in its settings.