App Visibility: make an app public or private (team-only)

Visibility controls which Ngris users can reach a hosted app at all. It is set per app, and independently for the production URL and the preview URLs, so you can (for example) keep production public while every deploy preview stays team-only.

Public vs private

• Public — anyone with the link can open the app. This is the normal, unchanged behaviour.
• Private — only members of the Ngris account that owns the app can open it. Everyone else is stopped at the edge (see enforcement below).

Defaults

New apps start with production = public and preview = private. Preview URLs are unreleased work, so they are team-only by default; you can flip a preview to public per app when you want to share it.

How enforcement works

Enforcement happens at the edge and is always on — there is no toggle to switch it off, and a public app is served exactly as before (byte-identical). For a private app, before the edge serves the request it requires the visitor to be:

1. signed in to Ngris, and
2. a member of the account that owns the app.

If the visitor is not signed in, the edge bounces them to sign in to Ngris and then returns them to the app. If they are signed in but are not a member of the owning account, they see a branded “You don’t have access to this app” page — signing in as a different account won’t help; an owner has to add them to the account (or they need to switch to an account that has access).

Where it applies

Visibility works both on Ngris platform domains (for example your app’s *.ngris.dev URL) and on your account’s own custom domains (bring-your-own-domain). Preview URLs — of the form <deploy-uuid>.<domain> — follow the preview visibility setting, independently of production.

Set it in the dashboard

Open the app, go to Settings → Visibility, and set Production and Deploy previews each to Public or Private.

Set it via the API

Update visibility with a PUT to the app’s visibility endpoint. Both fields are optional — send just the one you want to change and the other keeps its current value.

PUT /api/applications/{uuid}/visibility
Content-Type: application/json

{
  "prod_visibility": "public",
  "preview_visibility": "private"
}

Each field must be "public" or "private".

Not the same as Endpoint Auth

App Visibility is platform-side access control — which Ngris users can reach the app. It is not the same as Endpoint Auth, where an app owner runs their own login/registration for their end-users. The two are separate and are configured separately.

Availability

App Visibility is not plan-gated — it is available on every plan.