# Access protection

> Put a login wall in front of a public web app with no code: password protection or Google single sign-on, restricted to the people you allow.

Access protection puts a login wall in front of a public web app without writing any auth code. Turn it on from the deployment's **Security** tab and pick one of two modes.

## Two modes

### Password protection

Basic auth: a username and an org-viewable password. Anyone hitting the app has to enter them before they see anything.

### Single sign-on (Google)

Sign in with Google, restricted to the email domains or specific email addresses you list. No shared password to manage.

The two modes are mutually exclusive, a deployment runs one or the other, not both at once.

## Turning it on

1. **Open the Security tab**

   Go to the deployment's detail page and open **Security**.

2. **Pick a mode**

   Choose **Password protection** or **Single sign-on (Google)**.

3. **Set the credentials**

   For password protection, set a username and password. For single sign-on, list the allowed email domains or specific email addresses.

4. **Save**

   Ownkube updates the app's auth config and triggers a rolling update. Once it's live, visitors hit the login wall before reaching your app.

## Where it's available

- **Public web apps only.** Access protection applies to public web deployments, not workers, jobs, or databases.
- **Starter (K3s) clusters only.** The Security tab is grayed out on Production (EKS) clusters, with an explanation.
- **Requires a recent platform version.** If your cluster's platform version is below the floor this feature needs, the tab is grayed out with an explanation there too. Upgrade the platform to unlock it.

## Good for

Staging environments, internal tools, previews, and gating a site before launch, anywhere you want a public URL to exist without being open to everyone yet.

- [Deployments](/docs/features/deployments)
- [Map a custom domain](/docs/guides/custom-domain)

---

**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.