Skip to content
bohrbohr docs

Password protection

Settings › Authentication puts a username and password (HTTP Basic Auth) in front of your production site. Use it for a site that is not public yet, or for a client’s staging site.

  1. Under Method, choose Basic Auth (or None to turn protection off).
  2. Under Users, add at least one Username and Password (New user adds more). Usernames cannot contain spaces or :.
  3. Optional: under Open URLs, add paths that open without a password (New URL). Each path starts with /: the exact path, or every path starting with it when it ends with * (for example /api/webhooks/*).
  4. Click Save. Protection takes effect within a few seconds, without a deploy.

To change a password, type a new one; leaving it blank keeps the current one (Password kept — type to change it). bohr stores only salted PBKDF2-SHA256 hashes, never the passwords.

How it works

Section titled “How it works”
  • In your Cloudflare account: bohr’s deploy workflow wraps your site in a small gate that checks the credentials. The settings live in a secret of your production Worker (BOHR_SITE_AUTH), so turning protection on or off needs no deploy. The gate writes .bohr-gate.mjs and wrangler.bohr-gate.json at deploy time; they are never committed.
  • Hosted by bohr: bohr’s edge checks the credentials before your Worker runs.

The preview has its own, unlisted address and is not covered by this setting. Protection applies to the production site.