# Protecting review apps with basic auth

**URL:** <https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830>\
**Category:** Questions / Help\
**Tags:** elixir, proxy, login-only\
**Created:** [January 14, 2026, 8:58pm UTC](https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830 "2026-01-14T20:58:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JasterV](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jasterv/32/44011_2.png) [@JasterV](https://community.fly.io/u/JasterV)\
**Post date:** [January 14, 2026, 8:58pm UTC](https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830/1 "2026-01-14T20:58:27Z")

</div>

I’ve built my CI so on every pull request a review app is created.

I don’t want anyone to be accessing these review apps but only me and whoever I want to give access to.

I thought that a very simple solution could be to put basic auth at a proxy level, but I don’t know if there is a way to configure the Fly proxy for that and only for review apps.

Could someone point me in the right direction?

For context, I’m building a Phoenix app, but before writing any code for this in my app I wanted to explore the idea of doing it at a proxy level so requests don’t even reach the server if not authorized

---

<div class="post-metadata">

**Author:** ![lillian](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/lillian/32/49616_2.png) [@lillian](https://community.fly.io/u/lillian)\
**Post date:** [January 14, 2026, 9:32pm UTC](https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830/2 "2026-01-14T21:32:25Z")

</div>

there isn’t a built-in way to do this, but what I would probably do is remove IP assignments from your review apps and then use [fly-replay](https://fly.io/docs/networking/dynamic-request-routing/) from a router app that checks basic auth.

---

<div class="post-metadata">

**Author:** ![JasterV](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jasterv/32/44011_2.png) [@JasterV](https://community.fly.io/u/JasterV)\
**Post date:** [January 14, 2026, 9:55pm UTC](https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830/3 "2026-01-14T21:55:33Z")

</div>

I’ve never heart about fly-replay, I will give it a look and write back if I have any questions! And obviously try to summarize the solution if I get to implement it for future developers with the same use case as me:)

Thank you!

---

<div class="post-metadata">

**Author:** ![halfer](https://avatars.discourse-cdn.com/v4/letter/h/df705f/32.png) [@halfer](https://community.fly.io/u/halfer)\
**Post date:** [January 14, 2026, 9:56pm UTC](https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830/4 "2026-01-14T21:56:55Z")

</div>

Unless you’re expecting high levels of traffic, I’d just use a plugin:

> **[How to add and test HTTP basic authentication in a Phoenix web application](https://cultivatehq.com/posts/add-basic-authentication-to-a-phoenix-application/)**
>
> Short tutorial on how to add basic authentication to a phoenix web app.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/fly1/original/3X/6/e/6e8955d00cb218e186ebbe3a6ab06fefdce15290.svg) [@system](https://community.fly.io/u/system)\
**Post date:** [January 21, 2026, 10:49pm UTC](https://community.fly.io/t/protecting-review-apps-with-basic-auth/26830/6 "2026-01-21T22:49:30Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.