How to Password Protect Your Poe Canvas App
Restrict access with server-side password protection.
Restrict access to your published Poe Canvas app with a server-side password (Premium plan).
Overview
Password protection restricts access to your published app with a server-side password. The password is hashed with bcrypt (an OWASP-recommended algorithm) before storage — AppToPub never keeps it in plaintext — and verified server-side, issuing a time-limited session token on success.
This is true server-side protection: the app's HTML and JavaScript are never sent to the browser until the password is verified, so it can't be bypassed by inspecting the page source. Password protection is a Premium ($15/month) feature; Free and Basic plans don't include it.
Step-by-step instructions
- Upgrade to Premium — Password protection is a Premium-tier feature. Upgrade your plan from the Pricing page if you have not already.
- Open your Projects dashboard — Sign in to AppToPub and open the Projects page.
- Select the app to protect — Click the published app you want to lock down.
- Enable password protection — Open the app's settings panel and toggle Password Protection on.
- Set and save a password — Enter a strong password and click Save. The password is bcrypt-hashed server-side; visitors must enter it before the app loads.
Troubleshooting
Visitors say the password doesn't work
Passwords are case-sensitive. Confirm they're entering the exact password — including uppercase/lowercase, numbers, and symbols — and that you haven't recently changed it.
I forgot the password I set
You can't retrieve it because it's stored only as a hash, but you can set a new one any time from the Projects dashboard.
Frequently asked questions
Is password protection secure?
Yes. The password is bcrypt-hashed and verified server-side, and protected content isn't delivered to the browser until verification succeeds — it's not a bypassable client-side overlay.
Which plan do I need?
Premium ($15/month). It also includes 100 apps and all Basic features.