Feature
Access modes
One environment variable runs the docs open to everyone, or behind a single shared site password with signed sessions.
- The ACCESS_MODE environment variable decides how the whole site behaves: public serves every visitor, private asks for the site password first.
- There are no user accounts and no roles. Private mode checks one shared site password with a timing-safe comparison.
- A successful login issues a signed JWT session cookie with a 24-hour lifetime, bound to a fingerprint of the browser that logged in.
- Failed attempts are counted per caller and across the site, and enough of them lock out further tries until the window resets.
- Public mode sends 8 HTTP security headers, and private mode sends 9, adding X-Robots-Tag so locked docs stay out of search results.
Our documentation site is built with OwnDocs, running the same code you receive.