Tasks
Who can open your app
A published app can be open to anyone, behind a password, or limited to signed-in members of your workspace — set once in Settings and enforced on the server, not just hidden in the interface.
Publishing gives an app an address. Access decides who gets past the door. It is in Settings → General, under Access.
The three levels
| Level | Who gets in |
|---|---|
| Public | Anyone on the internet with the URL |
| Password protected | Anyone with the URL and the password you set |
| Invite only | Only signed-in members of this workspace |
The setting takes effect as soon as you save it — there is no republish needed.
Password protected
Set a password between 4 and 128 characters. Visitors land on a lock screen and type it once; their browser then remembers the unlock for that app, so they are not asked on every page.
Change the password at any time; anyone who has not unlocked yet needs the new one. This is the right level for a client preview or an internal tool that should not be findable, and the wrong level for anything genuinely sensitive — a shared password is only as private as the people you gave it to.
Invite only
Someone opening the app is sent to Dhanu to sign in, and comes back only if they are a member of the workspace the app belongs to. Nobody outside gets in, with or without the link.
Use this for internal tools built on real data.
It is enforced on the server
The gate is not a screen the app draws over itself. Locked apps refuse to serve their code, their assets and their data to anyone who has not passed it — so “view source” and “open the URL directly” do not get around it.
While it is unpublished
An unpublished app has no public address at all. Only people who can open the task it lives in can see it, in the preview.
Access controls who can open the app. It does not control what the app itself does with data — if your app talks to your workspace, see What your app can use, and if it has end users of its own, see Saving data and backends.