---
topic: app-login
needs_human: "Who should get in: their emails, or a shared password."
not_available: true
requires: [data, env-vars]
---

[← Guide home](https://embarko.ai/docs)

# Login and private apps

**On this page:** Steps, Limits, What to tell the person

> Plain words unless the person is a developer. Never invent a link, name or code. [Rules](https://embarko.ai/docs/prerequisites) Needs first: [data](https://embarko.ai/docs/data), [env-vars](https://embarko.ai/docs/env-vars).

Embarko does not provide login or private apps yet. Every app is public to anyone with its link. Build sign-in or a password gate into the app itself; it is a real server, so this works.

**Done when:** A person with access gets in, and a visitor without it is refused on every page.

**Steps**

1. Tell the person in one line: Embarko does not do this yet, so you will build it into the app.
2. Team login: a users table in SQLite under DATA_DIR, hashed passwords (bcrypt or argon2), and a session cookie. Ask the person who should have access.
3. Private app: a password gate on every route, with the password set as an env var, never in the code.
4. Deploy, then try it as someone with access and as someone without.

**Limits**

- No identity provider, OAuth, sessions or user store from Embarko.
- A hard-to-guess app name is not privacy.

**What to tell the person**

- explain: "Embarko doesn't handle logins yet, so I've added sign-in to your app itself. Who should have access?"

**Next:** Build it into the app, deploy, test both ways.

**Related:** [data](https://embarko.ai/docs/data) · [env-vars](https://embarko.ai/docs/env-vars) · [feedback](https://embarko.ai/docs/feedback)

---

[Guide home](https://embarko.ai/docs) · JSON: add .json