Protected Media and Collections

By default, everything on a published website is public. Mark a collection as protected to require viewers to be authenticated (or hold a share PIN) before they can see its pages and media. Use this for members-only video libraries, gated downloads, client galleries, and similar private content.

Protection is configured in your website's _admin.yml. This guide covers what protected: true does, how protected media is stored and served, and who can view it.

Marking a Collection as Protected

Add protected: true to any file or folder collection:

collections:
  - name: videos
    folder: _videos
    create: true
    protected: true
    fields:
      - name: name
      - name: video
        widget: video
      - name: thumbnail
        widget: image

  - name: playlists
    folder: _playlists
    create: true
    protected: true
    fields:
      - name: title
      - name: items
        widget: list
        fields:
          - name: name
          - name: image
            widget: image

The flag works the same way on file collections and folder collections. It defaults to false when omitted.

What Gets Protected

Setting protected: true gates two things:

Built pages

Any pages the collection outputs (for example, a folder collection with output: true, or routes that render its documents) require authentication to load. Unauthenticated visitors are intercepted before the page is served and sent to sign in.

Uploaded media

Files uploaded through image, video, and file widgets inside a protected collection are handled differently from public uploads:

	Public collection	Protected collection
Storage ACL	`public-read`	`private`
URL stored in content	Direct CDN URL	Proxy URL (`/app/obj/<collection>/…`)
Served by	CDN, cached	Authenticated proxy

For protected uploads the platform stores the file privately and writes a proxy URL into your content instead of a public CDN link. When a viewer's browser requests that URL, the platform re-checks their access on every request and, if allowed, issues a short-lived (1 hour) signed link to the underlying file. There is no public URL that bypasses the check, so a protected video can't be hotlinked or shared by copying its address.

You don't need to change your templates — keep referencing the widget's stored value as usual. The protection is applied automatically based on the collection the file was uploaded to.

Who Can View Protected Content

Access is evaluated in this order. The first match wins:

Platform staff — always allowed.
The website owner — always allowed.
Site collaborators with an edit or admin role — always allowed.
PIN holders — visitors who entered a valid share PIN for the site or collection.
Granted users and roles — anyone with an explicit access grant for the collection.
Everyone else — denied.

This means that as soon as you add protected: true, the content is locked down to your website's collaborators. To let anyone else in, you either share a PIN or create an access grant.

Behavior for blocked viewers

Not signed in → redirected to sign in (or shown the PIN prompt if a PIN exists for that content).
Signed in but not authorized → access is denied (403). Protected pages and media will not load.

Granting Access to Visitors

The quickest way to give visitors access without accounts is a share PIN. A PIN can be scoped to the whole website or to a specific protected page. Anyone who enters the PIN gets access to that content for 24 hours — no account required. This is ideal for client review galleries or time-limited access where creating user accounts would be overkill.

PINs are managed inline on the live website. When a signed-in collaborator opens a protected page, a floating Share button appears in the corner; it opens a panel to set, copy, or delete the PIN for that page. To enable this control, opt the website's pages in by adding a data-share attribute to the <html> or <body> tag in your layout:

<body data-share>

Without data-share, the floating Share button never renders and collaborators won't be able to create PINs from the page. The Sharing Protected Content how-to walks owners through using it.

Member accounts and roles

For ongoing, account-based access, pair protected collections with the roles and registration system:

roles:
  - name: member
    email_confirmation: true
    admin_approval: true

forms:
  - name: signup
    role: member

collections:
  - name: videos
    folder: _videos
    create: true
    protected: true
    fields:
      - name: name
      - name: video
        widget: video

Visitors register through the signup form and become member users on the website. Existing access grants are reviewed and revoked under Settings → Media Access in the dashboard, where each grant shows whether it applies to an individual user or a role and which collection it covers.

Note: Assigning a role to a user does not by itself unlock protected collections — a role only grants access where an explicit grant exists for that role and collection. A site collaborator with an edit or admin role always has full access regardless of grants.

Full Example

A members area with a protected video library and playlists, fed by a registration form:

roles:
  - name: member
    email_confirmation: true
    admin_approval: true

forms:
  - name: member_signup
    role: member

collections:
  - name: videos
    label: Videos
    folder: _videos
    create: true
    protected: true
    fields:
      - name: name
      - name: video
        widget: video
      - name: thumbnail
        widget: image

  - name: playlists
    label: Playlists
    folder: _playlists
    create: true
    protected: true
    fields:
      - name: title
      - name: items
        widget: list
        fields:
          - name: name
          - name: image
            widget: image

Troubleshooting

Collaborators can see protected media but visitors can't

That's expected. protected: true only admits website collaborators automatically. Share a PIN or grant access for the visitors who should be allowed in.

A protected video or image won't load on the published page

The viewer isn't authorized. Confirm they're signed in (or have entered the PIN) and that a grant or PIN covers that collection. Protected media returns no public URL, so it will simply fail to load for anyone without access.

Media uploaded before adding `protected: true` is still public

The public/private decision is made at upload time. Files uploaded while the collection was public were stored with a public URL. Re-upload them after marking the collection protected so they're stored privately and served through the authenticated proxy.

A protected page is publicly reachable

Protection is applied during the build. Make sure the collection's pages are actually output by that collection and that the website has been rebuilt since you added the flag. Publish the website to apply the change to the live site.

Custom Fields — Full _admin.yml collection reference
User Registration — Create member accounts from form submissions
Form Submissions — Build the signup form
Sharing Protected Content — Owner's guide to PINs and access

By use case

By team