Skip to main content
HTTP basic authentication in front of everything the site serves. Nginx asks for it, so the application never sees an unauthenticated request at all. The usual reason is a staging site that should not be indexed or wandered into.

​
Adding somebody

A username and a password. Shipways keeps the hash and not the password, so it can never be shown again — saving over a name that already exists is how you change one. Removing a user means they can no longer get past the prompt.

​
What it does and does not cover

It covers every request nginx serves for the site, including assets and API routes. Anything that talks to the site over HTTP needs the credentials, which in practice means webhooks and monitoring will break unless they carry them. It does not cover anything reaching the application another way — a queue worker, a scheduled job, or a database client. The deploy health check is unaffected: it asks the site for a page from the machine itself.

​
Basic auth is not encryption

Credentials go over the wire on every request. On a site with no certificate they go in clear text. Request one first.

​
The alternative

If what you want is “nobody but us, for now” rather than “these particular people”, maintenance mode with its bypass link is usually the better fit: one link, rotated each time, and no accounts to clean up afterwards.