LoginStart Free

SSO & Access Control

Restrict who can access your deployed apps with Telbase access protection. Add email-based login, Google, Microsoft, or GitHub sign-in with a single command. Visitors must authenticate before they can reach your app.

What Access Protection Does

Access protection adds an authentication gate in front of your deployed app, powered by Cloudflare Access. When enabled, visitors see a login page before they can reach any page of your app.

Separate from your app's auth
Access protection is independent of any authentication your app has internally. It protects the entire app at the network level — unauthenticated requests never reach your code. Think of it as a locked front door for your deploy URL.

This is ideal for internal tools, prototypes, and staging environments where you want to limit access to your team or specific people.

Enabling Access Control

1

Choose an identity provider

Pick how visitors sign in. The email code (onetimepin) is the default. Google, Microsoft and GitHub work when Telbase has them set up; there is nothing for you to set up.

2

Enable access protection

Run the enable command from the CLI, or turn it on in the app's Access tab in the dashboard.

bash
# Enable with email code authentication
telbase access enable onetimepin

# Verify it's active
telbase access status
3

Test the login

Visit your app's URL. You should see a login page asking for authentication before you can access the app.

Identity Providers

The simplest option. Users enter their email address and receive a one-time code. No external setup required.

bash
telbase access enable onetimepin

Combine with domain restrictions to limit which email addresses can request a code.

Changing the method keeps the session length, the allowed emails and the allowed domains. If a method is not set up on Telbase, the command and the Access tab say so and name the methods you can use; nothing changes.

Domain Restrictions

Restrict access to users with email addresses from specific domains. Only matching emails can authenticate, regardless of the identity provider.

bash
# Allow only company.com emails
telbase access domain add company.com

# Add another domain, one at a time
telbase access domain add partner-org.com

# List allowed domains
telbase access domain list

# Remove a domain
telbase access domain remove partner-org.com
Domain restrictions + email code
When using email code with a domain restriction, only emails matching the allowed domains can request a login code. This is the fastest way to restrict access to your organization without any SSO configuration.

Email Allowlist

Allow specific email addresses to access your app, even if they don't match any domain restriction. Useful for contractors, partners, or external reviewers.

bash
# Allow a specific email
telbase access allow [email protected]

# List allowed emails and domains
telbase access status

# Remove an allowed email
telbase access deny [email protected]

Session Management

Authenticated users receive a session that lasts 24 hours by default. After the session expires, they must re-authenticate.

bash
# Set custom session duration
telbase access enable onetimepin --session 8h

# Sign everyone out (they sign in again on their next visit)
telbase apps protect my-app --revoke

# See who signed in recently (up to 30 days back)
telbase access users

Session duration is a number of hours, such as 1h, 8h, 24h, 168h (a week) or 720h (30 days).

Where Sign-in Runs

Telbase runs sign-in for every app in its own Cloudflare account, so you set nothing up in Cloudflare or anywhere else. The sign-in methods are the ones Telbase offers: the email code is the default, and Google, Microsoft and GitHub work when Telbase has them set up. Ask telbase access enable <method> for one that is not, and it names the ones you can use.

Next Steps