Authentication and membership

Every app route, static asset, generated server handler, SDK module, and capability request passes the gateway's current access decision before generated code executes. App sessions are host-only, HttpOnly, short-lived, and bound to one app origin. Sessions entered through the shell refresh quietly while the app is in active use (membership is re-checked on every request, so a refresh never outlives a removal) and re-enter through the shell after long idle periods; open_app launch sessions stay non-refreshable for five minutes. Invite-only admits named members; link mode uses a secret share link whose signed-in visitors become members. Public mode is an explicit owner-confirmed exception: the app's own URL opens without sign-in, and anonymous guests can read and change shared KV and files. Guests are not members, do not count toward the people limit, see no member list, and cannot use Podda AI or notifications; each guest keeps one stable anonymous identity per browser. A member or owner who lands on a public app without a live session is routed back through sign-in rather than silently becoming a guest. Switching away from public revokes the guest path on the next request.

Last updated 22 August 2026 · Documentation version 7