Private app access
Make web applications private without changing the application stack
Protect an entire application or selected HTTP endpoints with identity-aware or private-network access, without adding authentication or networking code to the app.
- Protect the entire app or only selected HTTP endpoints
- Choose Cloudflare Access, Cloudflare One, or Tailscale
- Available with an active Team or Enterprise subscription
- Keep endpoint reconciliation and provider cleanup in the app lifecycle
Choose how approved users reach the application
Protect an application with identity checks or keep it inside a private network.
Identity protected
Publish through Cloudflare and require an approved identity policy before a browser can reach the app.
Private network
Keep endpoints reachable only from enrolled Cloudflare One devices or authorized Tailscale users and devices.
Protect the complete app or only the endpoints that need it
A private application does not have to mean an all-or-nothing network decision.
Entire app
Move every eligible external HTTP endpoint behind the selected access provider and suppress matching standard routes.
Selected endpoints
Protect an admin interface, staging service, dashboard, or operational tool while leaving unselected routes unchanged.
- Choose the primary protected endpoint users should open first.
- Give each protected service a stable address appropriate to the provider.
- Leave unselected routes operating normally when only part of the app should be protected.
Use the access provider that matches your organization
Cloudflare and Tailscale fit the same app-level workflow while providing different user experiences.
Cloudflare
Use protected publishing with a Cloudflare Access identity policy, or keep endpoints inside a Cloudflare One private network for enrolled devices.
Tailscale
Give authorized users and devices stable private HTTPS addresses inside an existing tailnet.
Review the Cloudflare integration or Tailscale integration before choosing a provider. Tailscale Node remains a separate use case for stacks where the network node itself is the workload being deployed.
Turn ordinary web stacks into internal applications
Apply private access to familiar application stacks without changing how the application is built.
Internal CMS and portals
Deploy Drupal or WordPress for an intranet, knowledge base, operations portal, or private publishing workflow.
Admin and preview tools
Protect staging sites, customer review environments, dashboards, and supporting interfaces without adding authentication to each app.
Private gateways
Keep OpenClaw and other operator-facing gateways available only to approved users.
Keep access attached to the app lifecycle
The protected path should change when the application changes.
- Suppress matching standard routes from the beginning when an app is intended to be protected.
- Reconcile provider endpoints when eligible app services and routes change.
- Restore standard routing when Application Access is removed.
- Clean up Wodby-managed connector and provider resources when the app is deleted.
Access work is visible in the app instance state and task history, so teams can follow provisioning, reconciliation, failures, and cleanup from the same operational surface as the app itself.
Use the right access control for the right boundary
Application Access, platform permissions, and route authentication solve different problems.
Application Access
Controls who can reach the running HTTP application through Cloudflare or Tailscale.
Platform access control
Controls who can view and operate Wodby projects, apps, clusters, stacks, and integrations.
Routes and ports
Controls standard HTTP routing, Basic Auth, custom domains, and published TCP or UDP ports.
Application Access protects eligible HTTP endpoints. It does not automatically publish databases or arbitrary TCP and UDP services.
Next step
Keep private applications private from the start
With an active Team or Enterprise subscription, protect the complete app or only selected HTTP endpoints through Cloudflare or Tailscale from the same app creation workflow.