Current
Private Generation Preview Access
Current public access behavior for generation previews and the planned private preview access
Current access behavior
Every generation preview is public today. Anyone who has the URL can open it without signing in to Doxa. The production site and custom domains do not use preview access control either.
Note:
Do not put secrets, credentials, or unpublished sensitive content in a project that generates previews. Treat every generation preview URL as public.
Preview URL types
Doxa currently serves two kinds of preview URLs. Both are public.
| URL type | Example | Current access |
|---|---|---|
| Permanent generation URL | flagforge--a1b2c3d4e5f6.doxa.page | Public |
| Pull-request channel | flagforge-pr-42.doxa.page | Public |
| Production site | flagforge.doxa.page | Public, no preview access control |
| Custom production domain | docs.example.com | Public, no preview access control |
A permanent generation URL uses your project slug, two dashes, and the first 12 characters of the generation's version ID. Each permanent URL resolves to one fixed generated version, so it keeps showing that version even after newer generations run.
Why private previews are not available yet
Doxa's dashboard session belongs to the Doxa sign-in domain. Browsers do not send that session to doxa.page or to custom domains. Because of this, a preview server cannot yet confirm who is asking for a preview.
Turning on a sign-in check now would send visitors to the dashboard sign-in page and back to the dashboard, without giving them access to the preview. For this reason, the check is not turned on.
Planned access model
The following behavior is planned and is not available yet.
Permanent generation URLs will require sign-in.
Pull-request preview channels will require sign-in.
Access by role: organization owners and administrators can open previews for every project in their organization. Regular members can open a preview when one of their teams has access to the project.
Cache and audit: when a preview becomes private, Doxa will clear any public copy of it and record access decisions.
Until these changes ship, share a preview only when its content is ready to be public. For teams and roles, see Teams, roles and invites.