How to Password Protect Your Poe Canvas App

When you convert a Poe Canvas app into a public web app, it's accessible to anyone with the link by default. That's great for broad distribution — but sometimes you want to restrict access. Maybe it's a client demo, an internal business tool, a paid utility, or simply something you're not ready to share publicly. AppToPub's password protection feature lets you control who can use your app.

How Password Protection Works

When you enable password protection on an AppToPub deployment, visitors who navigate to your app URL see a password prompt instead of the app itself. They must enter the correct password to proceed. Here's what happens behind the scenes:

1. You set a password through the AppToPub Projects dashboard
2. The password is hashed using bcrypt (an industry-standard algorithm recommended by OWASP) before being stored — AppToPub never stores your password in plaintext
3. When a visitor enters the password, it's verified server-side against the stored hash
4. On successful verification, the visitor gets a time-limited session token that grants access to the app

This is server-side protection — the app's HTML and JavaScript are never sent to the browser until the password is verified. It's not a client-side overlay that can be bypassed by inspecting the page source.

Step-by-Step: Add Password Protection

1. Log in to AppToPub. Go to your Projects dashboard.
2. Find the app you want to protect. Locate it in your list of deployed apps.
3. Open the app settings. Click the edit or settings icon next to the app.
4. Set a password. Enter a strong password in the password field. Use a mix of letters, numbers, and symbols. This is the password you'll share with authorized users.
5. Save. The password is immediately active. Anyone visiting the app URL will now see the password prompt.

Use Cases for Password Protection

• Client demos — Share the app URL and password with specific clients. Revoke access later by changing the password.
• Paid tools — If you sell access to your AI app, use the password as a simple access control mechanism. Share the password only with paying customers.
• Internal tools — Protect business utilities that shouldn't be publicly accessible. Share the password within your team.
• Beta testing — Gate access to an early version of your app while you gather feedback from a controlled group of testers.
• Portfolio pieces — Protect sensitive client work in your portfolio while still being able to show it in interviews by sharing the password on the spot.

Managing Passwords

Changing the password

Go to your Projects dashboard, open the app settings, and enter a new password. The change takes effect immediately — existing sessions will expire and visitors will need the new password.

Removing password protection

Clear the password field and save. The app reverts to public access — anyone with the link can use it without authentication.

Sharing passwords securely

Don't include the password in the same message as the app URL. Send the URL and password through separate channels (e.g., URL via email, password via text message) for better security.

Plan Requirements

Password protection is available on the Premium plan ($15/month). Free and Basic plans don't include this feature. If you need access control, upgrading to Premium also gives you 100 app slots, permanent hosting, custom URLs, and usage analytics.

Troubleshooting

Visitors say the password doesn't work

Passwords are case-sensitive. Make sure they're entering the exact password including uppercase/lowercase letters, numbers, and symbols. Also verify you haven't recently changed the password.

I forgot the password I set

You can always set a new password through the Projects dashboard. There's no way to retrieve the current password since it's stored as a hash, but you can replace it at any time.

Your app is now protected — but are your authorized users actually using it? Set up usage analytics to monitor how many visitors access your protected app, how often they engage with the AI features, and whether your access controls are working as intended.