How to make an AI-built web app private
Keep an app built with AI off the public internet. Share it with named people, your team or one link, and avoid homemade password pages.
A link is not private just because few people know it. Real privacy means the host checks who is asking before the app answers.
Why a password field in the app is not enough
Assistants often add a login page that compares a typed word with a value in the code. It can be bypassed, leaked in the source, and offers no way to remove one person later.
The levels of access
- Named people: only the email addresses you list can open it.
- Your team: everyone in your organisation.
- Anyone with the link: convenient, but treat the link as a key.
- Public: open to the world, for sites meant to be found.
Set it up
- Upload the folder, a .zip or a GitHub repo, or ask your assistant to deploy it over MCP. Cohostly shows draft settings first, and nothing goes live until you confirm.
- Choose “named people” and add their email addresses.
- They sign in once and the app opens; others see a sign-in wall.
- Remove a person at any time and their access ends.
Do not forget the data
Private access protects the app. Keep the data it shows in a store you control, and connect accounts with the narrowest permission, such as read-only access to one sheet.
Questions
Can I share an app with only my team?
Yes, share with everyone at your organisation or with named people.
Can I add a login to my app instead?
You can, but host-level sharing is safer and needs no code. See the journal note on adding login to an AI-built app.
Can I switch from private to public later?
Yes, visibility can be changed at any time.