Access control

Access control decides who can open your Public URL: a password page, a secret link, or IP and user-agent rules, enforced on LocalCan's servers, so protection keeps working while your machine is asleep.

The common case is sharing work that is not meant for everyone. You send a prototype to a client, a staging build to a stakeholder, or an API preview to a partner, and only they should be able to open it. Access control protects the Public URL (tunnel) itself, and the same protection covers the URL's Snapshot, with nothing extra to set up.

Access control vs Basic auth

LocalCan has two ways to put a password on a Public URL. They solve different problems:

Basic auth stays fully supported on every plan. Access control is the option that keeps working when your machine does not, and the only one that can protect a Snapshot.

Choosing a protection

Click a Public URL in the desktop app and open Access Control. The Protection picker offers three modes: Password, Secret link, and None (public). The IP and user agent rules under Advanced Controls apply on top of whichever mode you pick. Changes reach visitors within about 15 seconds.

Password

Pick Password and LocalCan generates a strong password right away, ready to copy and share. Visitors get a branded password page instead of the browser's login popup, so it works cleanly on phones and for non-technical clients. Entering the right password grants that browser access for 7 days.

You can reveal or copy the password at any time, type your own, or generate a new one. Changing the password signs every visitor out immediately.

Secret link

Pick Secret link and LocalCan mints a share link that opens the page for anyone who has it, with no password to type. Copy it from the Access Control screen and send it over a private channel. Opening the link grants that browser access for 7 days.

Regenerate the link and the old one stops working immediately, along with every session it granted.

Advanced Controls

IP and user agent rules filter visitors before the password or link is even considered, and a blocked visitor is turned away even with the correct password:

• Allowed IPs and Blocked IPs take exact addresses or CIDR ranges. Paste a whole list at once.
• Allowed User Agents and Blocked User Agents take patterns with * wildcards, like *GPTBot*.

A non-empty allow list blocks everyone not on it. This is handy for locking a staging URL to an office network, or keeping crawlers and bots away from a prototype.

Team policies

On the Teams plan, a policy can be saved under a name and shared across the team. Attach the same policy to many Public URLs, and one edit applies to all of them at once. That is the fastest way to rotate a client password that protects several URLs, and any teammate can make the change, even while the URL owner's machine is asleep.

On the Access Control screen, open the policy picker and choose Save as new team policy to promote the URL's current settings, or pick an existing policy from the list. A team policy's password is write-only after saving: you can replace it, but not read it back.

Configure with YAML

Access control can also be set in a project file with the policy endpoint key, either a team policy by name or an inline one-off:

endpoints:
  - provider: localcan
    url: my-app-12.localcan.dev
    policy: client-review

See Configuration → Access control for the full YAML schema. Editing YAML by hand is also how you set a secret link, IP and user agent rules, or a team policy without the desktop app. For password protection, the localcan CLI has direct commands, shown next.

From the command line

The localcan CLI password-protects a Public URL without the desktop app, against a running daemon:

# Password-protect a URL (LocalCan generates a strong password and prints it)
localcan access password my-app.localcan.dev

# Or set your own
localcan access password my-app.localcan.dev --set "my-shared-password"

# List what is protected, or read a URL's current password
localcan access ls
localcan access show my-app.localcan.dev

# Remove protection, making the URL public again
localcan access clear my-app.localcan.dev

access password prints the password to share and stores it with the project, so access show reads it back later. It sets the same edge-enforced protection as the desktop app, so it covers the URL's Snapshot as well.

From an AI agent

A coding agent connected through LocalCan's MCP server can lock a link down for you. After it publishes a prototype, ask it to protect the preview. It uses set_password to protect the URL and hand you the password, get_access_status to read the current one, and clear_access to make the URL public again. The tools that change things are off by default, so you turn them on once under Settings.