What is SphereGate?
Put a sign-in in front of any web service. SphereGate checks every request before it reaches your app, so your code doesn't change.
In the console it's called Access protection, on your service's Settings › Networking.
app.example.com/webhooks/ goes straight through, with no sign-in.Ways in
Under How visitors get in, pick one method per service:
| Method | Who gets in | Good for |
|---|---|---|
| Off | Anyone who has the address | Public sites and APIs |
| Team sign-in | People in your ComputeSphere account, by account role | Internal tools, staging, previews |
| Password | Anyone with the password | Demos, client review |
Two settings work with any method, Off included:
- Limit by IP address: only requests from addresses you list get in.
- Always-public paths: paths anyone can open, for webhooks and health checks.
Turn it on
- Open your service, then Settings › Networking, and find Access protection.
- Select Edit, choose a method under How visitors get in and fill in its fields.
- Select Save. The console shows "Saved. Applying to every address of this service…" until it's in place.
To turn it off, choose Off and select Save.
Only people who can edit the project can change access protection.
Limit by IP address
You set allowed IP addresses in the service's Networking settings, above Access protection. See Networking for the steps and limits.
With a method on, a visitor needs an allowed IP address and a sign-in. A visitor from any other address sees a page saying the service isn't open to their network, and isn't asked to sign in.
Custom domains
Protection applies to your service's default address and to every custom domain attached to it, including domains you add later.
A sign-in counts on one address. Signing in on app.example.com doesn't sign you in on admin.example.com or on the default address. Each address asks once.
What visitors see
A visitor who isn't signed in gets a SphereGate page instead of your app. Your service's name is the headline, and every page says Protected by SphereGate and Hosted on ComputeSphere. Pages follow the visitor's light or dark setting.
| Page | When |
|---|---|
| Sign in to open service | Team sign-in, before signing in |
| Enter the password to open service | Password, before the right password |
| Sign in with two-step to open service | Team sign-in: your account requires two-step sign-in, and the visitor signed in without an authenticator app or a passkey. See Two-step sign-in. |
| You don't have access to service | Signed in, but not allowed. The page shows the address they signed in as. |
| Service isn't open to your network | The visitor's IP address isn't allowed |
| Too many tries | Several wrong passwords in a row |
| Your session ended / You're signed out | The session ran out, or the visitor signed out |
| Sign-in is unavailable right now | SphereGate can't check who someone is. See below. |
Sessions and sign-out
A sign-in lasts an hour at a time. When it runs out, SphereGate checks again: a visitor who's still allowed carries on without seeing a page, for up to 24 hours after they signed in. After that, they sign in again.
A sign-in also ends when the visitor signs out at /.well-known/spheregate/logout, or when you change the method, the password or who's allowed: any of those changes signs everyone out.
In your app
Your app gets headers that say who signed in, and a signed token, X-SphereGate-Token, to check them with. The token's issuer, audience and your service's policy ID are on the Access protection card under For your app. See Using SphereGate in your app.
What SphereGate doesn't cover
- Private traffic. SphereGate protects your service's public addresses. Calls between services in the same environment over the private network aren't checked.
- Datastores and volumes. Databases, caches, queues and SphereFiles volumes are already private to your environment. SphereGate doesn't change them.
- Programs that can't sign in. Use always-public paths for webhooks and health checks.
- The CLI and the public API. Access protection is set in the console.
- Other service types. Only web services have access protection. A service that's still private to you gets it when you make it public.
If sign-in is unavailable
Visitors see a page saying sign-in is unavailable, and nobody gets in without a valid session. People already signed in keep working for up to an hour.