Publishing & Access
Publish an app as a version, roll back to an earlier one, protect it with a password, and manage its public address.
Visitors never see the draft. Publishing takes a snapshot of the draft as a new version and serves it at the app's address; you keep editing the draft without changing what visitors see until you publish again.
Publishing a version
Open the Publish tab and click Publish draft…. The publish dialog shows "What visitors will get. The draft is checked on the server again when you publish.":
| Line | What it lists |
|---|---|
| Workflows | Workflows the app can run, with a uses org credentials badge where a workflow uses your organization's connected accounts |
| Hosts | External hosts the app may call (and the ones you chose to ignore) |
| Libraries | Libraries added to the app |
| Access | Who can open it |
| Size | Number of files and total size |
Click Publish (the button reads Publish as v<n>). The app needs an index.html to publish. After publishing, the tab shows "Visitors see v<n> at <address>" with Copy address.
Publishing needs the Publish forms and pages permission for Members - without it the button reads "Publishing requires permission from your admin". Owners and Admins can always publish.
What can block publishing
"Everything in an app is public. Secrets, internal addresses and server variable names must not be in its files - move the call into a workflow."
If the draft contains something that looks like a credential - an API key, a token, a password in a URL, a Bearer header - the dialog shows Cannot be published with the file and line, and Open file takes you there. Remove it and keep the secret in a workflow (for example in an MCP server's configuration or a secret global variable) instead.
Warnings you confirm
Some findings do not block publishing but need a decision:
- Hosts the app did not declare - the app's files mention outside hosts it has not declared. Calls to an undeclared host are blocked by the browser, which you can see in the preview. Declare adds the host to Settings > External hosts; Keep undeclared leaves it blocked and stops asking about it at the next publish (it is listed under Ignored hosts in Settings, where you can ask about it again).
- Open to anyone, with your organization's accounts - "Anyone with the address can run a workflow that uses your organization's connected accounts and see what they return. Consider a password (Settings → Access)."
- Nothing to call - no workflow is bound and no host is declared. "That is fine for a static app."
Tick I understand. for each one, then publish. If the draft changed while the dialog was open, it is checked again.
Versions and rollback
The Versions list in the Publish tab shows each published version with its file count and size; the one visitors see is marked Served. Serve this version switches visitors to an earlier version immediately - the draft is not touched. FlowTrux keeps the served version and the three most recent ones; older versions are removed.
Access
Settings > Access decides who can open a published app:
| Mode | Meaning |
|---|---|
| Anyone with the address | "The address is public - like a website." |
| One shared password | "Visitors type a password you share with them; it lasts 7 days per browser." At least 8 characters. |
| The app signs visitors in itself | "Served like a public address; your app's own sign-in (an outside service) decides who sees what." |
Changing the password signs every visitor out. Removing it asks Remove the password? first. Access changes reach visitors within a minute.
The draft preview in the editor never asks for a password.
The address
A published app lives at https://<organization-address>.flowtrux.ai/<app-slug>. The address is shown in Settings > Address and on the Publish tab.
- The organization address is edited by Owners and Admins in Settings > Organization > Address ("The address of your organization's apps. Lower-case letters, digits and dashes, 3–40 characters."). Changing it breaks links to your apps that you have already shared.
- Old links from before apps had their own addresses -
/r/<token>for shared pages and/f/<token>for forms - redirect to the app's address while the app is published. - An app can't be shown inside a frame on another website; link to its address instead.
Unpublishing
To take an app offline, delete it from the Apps list (its address stops working at once, with every version and its submissions). To keep it but restrict it, switch Access to One shared password.
Related
- Apps Overview
- Members & Roles - the publish permission
- JavaScript API - external hosts and
FlowTrux.fetch