Access Control

Control who can read your docs. Keep a collection internal so only your team can see it, or publish it and put a password on it so only people you share the password with can read it.

#

Choose the right level of access

You want Do this
Only your team can read it Leave the collection unpublished. It stays inside your workspace, and access follows your members and roles.
A limited outside group can read it (partners, beta customers, a client) Publish the collection and turn on password protection.
Anyone can read it Publish the collection with no password.
#

Turn on password protection

Only the workspace Owner can change access control, and the section appears only after the collection is published.

  1. Open the collection and click Settings in the left sidebar.
  2. Open the Publish Collection tab. Make sure it says Collection is Public & Live.
  3. Under Access Control, turn on Password protect this collection.
  4. Enter the password in Set a password, then again in Confirm password.
  5. Click Save password.

You see "Password protection updated". The whole published collection is now protected: every page, the landing page, and the .md Markdown versions of pages.

#

What readers see

When someone opens a protected page, they see This page is password protected and a password box.

  1. They enter the password.
  2. They click Unlock.

After a correct password, the browser stays unlocked for 24 hours. Then the reader is asked again.

If a reader enters a wrong password 5 times, they are locked out for 15 minutes and see "Too many attempts. Please try again later."

#

Change or remove the password

  • Change it: with the toggle on, enter a new password in both fields and click Save password. Leave the fields blank to keep the current one. Readers who unlocked the site earlier keep access until their 24 hours run out.
  • Remove it: turn off Password protect this collection and click Turn off password protection. The collection becomes open to everyone again.
#

Limits

  • The password applies to the whole collection. You can't protect single pages. To share only some pages, put them in a separate collection.
  • The password is shared by everyone. There are no per-reader accounts or access logs on the published site.
  • Protected pages can't be read by search engines or AI crawlers, so they won't rank in search.
  • Page names and links can still appear in the collection's sitemap.xml and llms.txt. Don't put sensitive information in page titles.
  • Restricting access by IP address is not available in settings.
  • Unpublishing the collection takes the site offline for everyone, including people who know the password.
#
Built with DocStar