---
topic: lock
connector: "deploy_app: embarko.json with \"lock\": true is one of the files"
api: "POST https://ship.embarko.ai/apps (embarko.json travels in the upload)"
needs_human: "Only if they want a password: they set it in the dashboard. You can never set or see it."
requires: [embarko-json, claim]
---

[← Guide home](https://embarko.ai/docs)

# Private apps (App Lock)

**On this page:** Steps, Examples, Limits, Errors, What to tell the person

> Plain words unless the person is a developer. Never invent a link, name or code. [Rules](https://embarko.ai/docs/prerequisites) Needs first: [embarko-json](https://embarko.ai/docs/embarko-json), [claim](https://embarko.ai/docs/claim).

A locked app asks every visitor to sign in with an Embarko account that belongs to the app's workspace before any page is served. The owner can also set a password in the dashboard for people outside the workspace. Lock it by writing "lock": true in embarko.json and deploying. Every app is public until its owner locks it.

**Connector:** deploy_app: embarko.json with "lock": true is one of the files

**Done when:** The deploy reply has app.lock.locked true, and opening the app's link in a private window shows the Embarko lock page instead of the app.

**Steps**

1. Ask the person once, in plain words: "Should only your team be able to open it?" Lock only on a yes.
2. Add "lock": true to embarko.json in the app's top folder (create the file if there is none; see embarko-json). Deploy as usual.
3. Read the reply: app.lock.locked is true and links.lock is the dashboard page where a password can be set.
4. Tell the person: the app now asks for an Embarko sign-in, and anyone in their workspace gets in. If others need access, they set a password at links.lock. Never ask for or handle that password.
5. To open it again, deploy with "lock": false. Leaving the key out changes nothing.

**Example: embarko.json that locks the app**

```json
{
  "$schema": "https://embarko.ai/schema/embarko.json",
  "lock": true
}
```

Sign-in mode. A password is added in the dashboard, never here: this file is code.

**Limits**

- Everything on the app's address is blocked for a visitor who has not signed in: pages, files, API routes, webhooks. A locked app cannot receive calls from other services. The owner chose this; do not work around it.
- Who gets in: members of the app's workspace, plus anyone with the password if one is set. There is no invite list.
- The password is set only in the dashboard, by a person. Never put it in embarko.json, env vars or code.
- A temporary (unclaimed) app cannot be locked: the deploy goes ahead and warns lock_ignored_orphan. Claim it first.
- Locking, unlocking or changing the password signs every current visitor out of the app.
- A hard-to-guess app name is not privacy. Use the lock.

**Errors**

| Code | Status | Retry | What to do |
| --- | --- | --- | --- |
| `invalid_embarko_json` | 400 | No | "lock" must be true or false. Fix the file and deploy again. |
| `lock_ignored_orphan (warning)` | 202 | No | The app is temporary, so the lock was not applied. Claim it (see claim), then deploy again with the same file. |

**What to tell the person**

- explain: "Your app is private now: it asks for an Embarko sign-in, and everyone in your workspace can open it. If you want to let in people outside your team, set a password here: {links.lock}."

**Next:** Deploy with "lock": true, confirm app.lock.locked in the reply, and tell the person where the password is set.

**Related:** [embarko-json](https://embarko.ai/docs/embarko-json) · [claim](https://embarko.ai/docs/claim) · [env-vars](https://embarko.ai/docs/env-vars) · [feedback](https://embarko.ai/docs/feedback)

---

[Guide home](https://embarko.ai/docs) · JSON: add .json