Documentation
Access control
Docs are public by default, which is usually the point. When they shouldn't be, a project can gate its docs behind a password or SSO.
Modes
| Mode | Who gets in |
|---|---|
public | Anyone with the URL. The default |
password | Anyone with the shared password |
sso | Members who authenticate through your identity provider |
Password
Readers hit a gate, enter the password, and stay unlocked for the session via a signed token.
Everyone gets the same password, so it leaks the moment one person pastes it into a ticket, and revoking it locks out everyone at once. It's a speed bump for a private beta, not access control for sensitive material.
For anything that actually matters, use SSO.
The password hint is shown on the gate, so readers who should know it can be reminded without you handing it out again.
SSO
Readers authenticate against your identity provider. Access follows your directory: someone who leaves loses access when their account is deactivated, without you touching Octri.
What's gated
The gate covers the docs site. Two things stay reachable regardless:
If an endpoint must not be called, protect the endpoint. Hiding its documentation stops nobody: the URL is in your SDK, your logs, and your network traffic.
Docs gating is about not publishing work in progress, not about defence.
Unpublished pages
A guide that has never been published is not reachable at its URL, regardless of the access mode. That's the simplest way to keep a page private: don't publish it yet.