1 min read
Password Gate Setup
Portable privacy quickref for the wiki reader: private page content must stay server-gated and never ship to the client before authentication.
Open this page when deploying the wiki UI, changing visibility, debugging unlock behavior, or adding per-page gate passwords.
Environment
Set WIKI_GATE_PASSWORD in Vercel for production and preview as needed. Never commit password values.
| Mechanism | Use |
|---|---|
WIKI_GATE_PASSWORD |
One or more global passwords, comma- or newline-separated. |
WIKI_GATE_PASSWORDS |
Additional global password env surface. |
Page gate_passwords frontmatter |
Per-article unlock that grants only the target slug. |
Flow
- Private pages render
<PasswordGate slug="..." />server-side. - Client posts
{ password, slug? }to/api/unlock. - Route checks global env passwords first, then page
gate_passwords. - On success, server sets an httpOnly cookie for global or slug-scoped unlock.
- Hidden/private pages stay out of listings/search until unlocked.
Safety Rules
- Do not expose gate passwords in client bundles, markdown, logs, screenshots, or generated packs.
- Combine Public Categories Env with this gate; category hiding alone is not authentication.
- Treat privacy regressions as security bugs.
Timeline
- 2026-07-01 | Rebuilt as the privacy quickref for server-side unlock, env surfaces, per-article passwords, and category visibility boundaries. Source: User request, 2026-07-01
- 2026-06-07 | Multiple global passwords (
WIKI_GATE_PASSWORDS) and per-articlegate_passwordsfrontmatter. Source: User, 2026-06-07; ui/src/lib/gate-passwords.ts - 2026-05-31 | Agent doc from unlock route and ui README. Source: ui/src/app/api/unlock/route.ts, 2026-05-31