Private apps

An app is public by default: anyone with the link can open it. A private app can only be opened by the members of the team that owns it, or only by you if it belongs to your personal account. It suits internal tools, admin pages, previews and anything you don’t want to show the world yet.

Turn it on

Dashboard

Open the app and press Make private under Access. Make public undoes it.

CLI

flitzy access notes private     # or: public; without a mode it shows the current setting
flitzy deploy --private         # set it with a deploy (--public undoes it)

flitzy.json

{ "name": "notes", "private": true }

The setting in flitzy.json is applied on every deploy, so it wins over a change in the dashboard. Leave it out to manage access in the dashboard instead.

Agents (MCP)

deploy_app with private: true, or the set_app_access tool.

The change takes effect within seconds, without a redeploy. It covers every address of the app: <name>.flitzy.app and its custom domains.

What visitors see

1. A visitor without access is sent to the Flitzy sign-in page.
2. They sign in with their Flitzy account. If they are in several teams, Flitzy switches to the team that owns the app by itself.
3. Members land on the page they wanted to open. Everyone else sees “No access” and can sign in with another account.

The sign-in lasts 7 days per app. It ends earlier when the visitor is removed from the team. To sign out of one app, open https://<name>.flitzy.app/.flitzy/signout.

Requests that don’t come from a browser page (fetch from another site, curl, webhooks) get 401 instead of the sign-in page. Calls from the app’s own pages work as usual, since the browser sends the sign-in cookie along.

Caution

Webhooks from services like Stripe or GitHub can’t sign in. An app that receives them should stay public, or receive them in a second, public app.

Who is signed in

Every request that reaches a private app carries two headers:

Header
X-Flitzy-User	The visitor’s Flitzy user id, for example u-3idbomj2.
X-Flitzy-User-Name	Their name, URL-encoded (decodeURIComponent it).

Flitzy sets these itself and removes any a visitor sends, so on a private app you can trust them. A public app never gets them.

// Express
app.get('/', (req, res) => {
  const name = decodeURIComponent(req.get('X-Flitzy-User-Name') || '');
  res.send(`Hello ${name}`);
});

Good to know

• Who may make an app private or public: every member of the team, like deploying.
• The activity log records each sign-in, including people who were turned away, and every change of the setting.
• The paths /.flitzy/callback and /.flitzy/signout belong to Flitzy on a private app; your app never sees requests to them.