Access control
Docs are public by default, which is usually the point. When they shouldn't be, you can put your docs behind a password or your identity provider.
Find this in Docs settings, under Docs access.
Modes
| Mode | Who gets in | Plan |
|---|---|---|
| Public | Anyone with the URL. The default | Every plan |
| Password protected | Anyone with the shared password | Every plan |
| SSO | People who sign in through your identity provider | Enterprise |
Password
Readers land on a gate, enter the password, and stay unlocked for 24 hours.
- Choose Password protected
Enter a password of at least 8 characters. Octri stores only a hash of it.
- Add a hint, if you like
The Password hint is shown on the gate, to remind readers who should know it where to find it. Don't put the password in it.
- Save
It applies straight away.
To change the password, enter a new one. Leave the field blank to keep the current one.
Each IP address gets 5 attempts per hour on a project, after which the gate says to try again later.
It leaks the moment one person pastes it into a ticket, and changing it locks out everyone at once. It's fine for a private beta. For anything sensitive, use SSO.
SSO
Readers sign in with your organization's identity provider before they can read the docs. Access follows your directory, so someone who leaves loses access when their account is deactivated.
- Set up your organization's SSO
Docs use the provider you configured under account security. It must be turned on.
- Choose SSO
Under Docs access, select SSO. There's nothing else to configure for the docs.
Readers don't get a dashboard account. Their sign-in only proves they may read this project's docs.
What's gated
The gate covers the site and the public data behind it.
| Public | Password or SSO | |
|---|---|---|
| Pages and endpoint reference | Open | Gated |
| Search and AI chat | Open | Gated |
sitemap.xml | Open | Gated, because it lists every page |
llms.txt | Open | Gated |
robots.txt | Open | Open, and tells crawlers to stay out |
Two things stay reachable whatever you choose:
| Why | |
|---|---|
| Published SDK packages | A package on npm or PyPI is public, and it contains your endpoint list |
| Your API itself | Docs access and API access are separate |
If an endpoint must not be called, protect the endpoint. Hiding its documentation stops nobody: the URL is in your SDK, your logs and your network traffic.
Your MCP server
Self-hosted MCP servers read your docs over the same public routes. When your docs are gated, they can't read those routes, so features such as outage warnings don't reach them.
Other ways to keep a page private
| Option | What it does | Still reachable by URL? |
|---|---|---|
| Never publish it | The page isn't live | No |
| Hide it in the navigation | Takes it out of the sidebar | Yes |
| Redirect it | Sends readers elsewhere | No |
| Docs access | Gates the whole site | Only after signing in |
Access is set for a whole site, not per page. For material only some readers should see, use a separate project.