--- title: "[Contentstack Launch] - Contentstack Authentication for Environments" description: Contentstack Authentication for Environments url: https://www.contentstack.com/docs/launch/contentstack-authentication product: Contentstack Launch doc_type: guide audience: - developers - administrators version: unknown last_updated: unknown --- # [Contentstack Launch] - Contentstack Authentication for Environments This page explains how to configure Contentstack Authentication to restrict access to Contentstack Launch environments (development, staging, production) to signed-in members of your Contentstack Organization. It is intended for Launch users who manage projects and environments and should be used when setting up or updating environment access controls. ## Contentstack Authentication for Environments Development, staging, and production environments are common stages of software development. Each stage deploys and operates an application in an isolated environment. The system usually restricts access to development and staging environments from public access, as these environments are where new features, code changes, and updates are tested, built, and validated before being published. Contentstack Authentication restricts access to a Launch environment to signed-in members of your Contentstack Organization. When enabled, Contentstack sends every visitor through Single Sign-On (SSO) before they can view the site. Search engines, unauthenticated users, and users from other Contentstack Organizations cannot access the environment. Since access is identity-based rather than shared, you can see who accessed the site and revoke individual access by managing your organization membership. Use this guide to configure Contentstack Authentication at project creation, environment creation, or in Environment Settings in Contentstack Launch. ## Prerequisites - [Contentstack account](https://www.contentstack.com/login/) - Access to Launch for your organization - A project already deployed in Launch ## Configure Contentstack Authentication Contentstack Authentication can be configured in three ways: - During Project Creation - During Environment Creation - From Environment Settings **Note:** When Contentstack Authentication is enabled, all members of your Contentstack Organization can access the protected environment. ### Configure Contentstack Authentication During Project Creation Follow these steps to enable or disable Contentstack Authentication when creating a new Launch project: - From the Launch landing page, click **+ New Project**. - Enter your project details and configure your deployment as usual. - Under **Site Access**, use the **Enable Contentstack Authentication** toggle to set the access level:**Enabled (default):** All environments created under the project are protected by Contentstack Authentication. - **Disabled:** All environments created under the project remain publicly accessible. - Click **Deploy**. **Note:** Contentstack Authentication is applied at the environment level. All domains within this environment are automatically gated behind Contentstack SSO. ### Configure Contentstack Authentication During Environment Creation Follow these steps to enable or disable Contentstack Authentication while creating a new environment in an existing project: - From the Launch landing page, open your project. - On the **Environments** screen, click **+ New Environment**. - Enter the environment details. - Under **Site Access**, use the **Enable Contentstack Authentication** toggle to set the access level:**Enabled (default):** The environment is protected by Contentstack Authentication. - **Disabled:** The environment remains publicly accessible. - Click **Create**. **Note:** Contentstack Authentication is applied at the environment level. All domains within this environment are automatically gated behind Contentstack SSO. ### Configure Contentstack Authentication from Environment Settings Follow the steps below to enable or disable Contentstack Authentication for your environment: - From the Launch landing page, click the **project card** to open your project. - In the **Environments** screen, go to the environment for which you want to provide Contentstack Authentication, click the **vertical ellipses** under **Actions**, and then click **Settings**. - In **Settings > Environments**, click the **Site Access** tab. - Click the **Enable Contentstack Authentication** toggle to enable or disable it. **Note:** - Contentstack Authentication is applied at the environment level. All domains within this environment are automatically gated behind Contentstack SSO. - Disabling Contentstack Authentication allows anyone with the environment URL to access your environment (unless Password Protection is also enabled—in which case the environment remains gated by the password). - If a user is removed from the organization, the user can continue to access the site for up to **1 hour** before their access is revoked. ## Why Contentstack Authentication is More Secure Than Password Protection Contentstack Authentication provides stronger access control than Password Protection for the following reasons: - **Identity-based access:** Every visitor signs in with their own Contentstack account. There is no shared password to pass around, screenshot, or leak in chats. - **Per-user revocation:** Access is tied to Contentstack Organization membership. Removing someone from your organization immediately removes their access to every protected environment, with no password rotation required. - **Traceable access:** Because every visitor authenticates with their own identity, you can tell who accessed the environment. Password Protection cannot distinguish between users of a shared credential. Audit records for users who access the environment through Contentstack Authentication are available in the Audit Logs under Organization Admin. - **Automatic scoping to your Organization:** Only members of your Contentstack Organization can be granted access — users from other Contentstack Organizations cannot sign in, even if they know the URL. ## Using Contentstack Authentication Together with Password Protection Contentstack Authentication and Password Protection can both be enabled for the same Launch environment. When both are enabled, visitors first authenticate through Contentstack SSO and then complete Password Protection. Access is granted only after both authentication steps are successful. ## Common questions ### Who can access an environment when Contentstack Authentication is enabled? All members of your Contentstack Organization can access the protected environment. ### Is Contentstack Authentication applied at the project level or environment level? Contentstack Authentication is applied at the environment level. ### What happens if Contentstack Authentication is disabled? Disabling Contentstack Authentication allows anyone with the environment URL to access your environment (unless Password Protection is also enabled—in which case the environment remains gated by the password). ### Can Contentstack Authentication be used together with Password Protection? Yes. When both are enabled, visitors first authenticate through Contentstack SSO and then complete Password Protection. Access is granted only after both authentication steps are successful.