> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zenith.hosting/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Start with https://docs.zenith.hosting/content/quickstart.md. Use NO_COLOR=1 for plain CLI output in non-interactive agent sessions. Run without a TTY and supply explicit template and publishing inputs; NO_COLOR does not bypass prompts or authorization.
> For temporary deployments, read https://docs.zenith.hosting/content/up.md. For publishing and review, read https://docs.zenith.hosting/content/publish.md. A preview uploads local files; publishing uses a pinned public GitHub commit.
> Before creating, changing, or approving zenith-compose.yml, read https://docs.zenith.hosting/llms.txt, then read https://docs.zenith.hosting/content/zenith-compose.md and the complete public schema at https://docs.zenith.hosting/content/zenith-compose-reference.md. Generate only documented fields and follow their validation and completion checks.
> Before creating, changing, publishing, or verifying a container image for Zenith, read https://docs.zenith.hosting/content/containerise.md.
> Treat these live Markdown pages as the source of truth instead of relying on memory or a copied Zenith Compose specification.
> Do not push commits, submit an app, merge pull requests, publish container images, or change registry visibility unless the user explicitly authorizes that external action. Do not bypass browser OAuth, GitHub connection, or Developer Agreement acceptance.

# Protect an app with forward authentication

> Require the deployment owner's Zenith account before requests reach an app endpoint.

Use forward authentication to restrict an HTTP endpoint to the deployment owner's Zenith account. Zenith checks access before forwarding requests to the app. If the app has its own login, configure that login separately.

> [!WARNING]
>
> Every path on a protected hostname requires Zenith authentication. Do not enable this setting on an endpoint that accepts public webhooks or unauthenticated API clients.

## Protect an endpoint

Add `forward_auth: true` to each `x-zenith.expose` entry that needs protection:

```yaml theme={"theme":{"light":"github-light-default","dark":"vitesse-black"}}
x-zenith:
  expose:
    - service: app
      port: 3000
      web: true
      forward_auth: true
    - service: admin
      port: 3001
      label: admin
      web: true
      forward_auth: true
```

Add these entries to your existing manifest. Replace the service names and ports with your app's values.

Configure every endpoint separately. A labelled endpoint does not inherit protection from the primary endpoint, even when both reach the same service. A verified custom domain inherits the primary endpoint's setting.

Set `forward_auth: false` or omit the field to leave an endpoint without this check. `web: false` does not bypass forward authentication.

## Check access in a browser

Test a hosted deployment. Development previews reject `forward_auth: true`, and local Docker Compose does not enforce Zenith authentication.

> Verify anonymous redirection, owner sign-in, explicit destination confirmation, and denial for another account. Do not treat a login page as evidence that the app is healthy.

Check every exposed hostname for an unprotected route to the same private data. Unauthenticated API requests and WebSocket upgrades receive a denial instead of an interactive login redirect.

For app accounts and access by additional Zenith members, use [Sign in with Zenith](https://docs.zenith.hosting/content/sign-in-with-zenith) if your app supports OpenID Connect.

See the [forward authentication reference](https://docs.zenith.hosting/content/zenith-compose-reference.md#forward-authentication) for request handling, session revocation, and endpoint interactions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.