Fastr Workspace - Set Protection – Fastr Community

Overview

You can control who is able to view a published experience in Fastr Workspace using Manage Protection. This lets you share a publication that only opens for the right people — ideal for pricing PDFs, early-access catalogs, internal-only content, or anything else that isn't meant for a public audience. There are two ways to protect a publication:

Password — set a single password and share it with the people you want to grant access to.
Single Sign-On (SSO) — let viewers sign in with their own organization account through a third-party identity provider (Microsoft Entra, Okta, Auth0, Google, Ping, and other OIDC providers).

A publication uses one method at a time — Password or SSO, not both.

Before you start, you'll need a Publication slot with a PDF uploaded and ready to publish. For help getting there, see Fastr Workspace - How to upload a PDF.

Who can manage protection

Protection is restricted to Admin users. Editors and Viewers will not see the Manage Protection option in the slot menu. If you need to set, change, or remove protection on a publication and don't see the option, please reach out to an Admin on your account.

Important: Direct-link publications only

Protection currently applies to direct-link publications only — the link you copy from the Direct URL button. It does not apply to publications embedded on your own site via script tag (for example, embedded on a Shopify page). If you need a publication to be private, share it as a direct link rather than embedding it.

Note: Support for protection on embedded publications is planned for a future release.

Opening Manage Protection

In your content slot, click the three dots (…) menu.
Select Manage Protection.
Choose the tab for the method you want to use: Password or Single Sign-On (SSO).

Option 1: Password protection

Open Manage Protection and select the Password tab.
Enter the password you'd like to use and click Save.
Republish the slot. Password protection only takes effect once the slot is republished after the password is set.
Once republished, you'll see a lock indicator on the slot, confirming that the publication is protected.

Share the protected link (copied from the Direct URL button) along with the password. Recipients will land on a login page, enter the password, and be taken directly into the publication.

Updating or removing a password

To change or remove the password later, open Manage Protection and select the Password tab again. You'll have three options:

View your current password, so you can confirm it or share it again if needed.
Change the password to a new value.
Remove the password entirely, returning the publication to an unprotected state.

Save your change and republish the slot for it to take effect.

Option 2: Single Sign-On (SSO)

With SSO, viewers log in with their own organization account. You set this up once with your identity provider (IdP), then enter a few details into Fastr.

Step 1 — Create an application in your identity provider

In your identity provider, create a confidential OIDC application — the Web Application / Regular Web Application type that issues a client secret. Do not choose a Single-Page Application (SPA) or any public-client option, as those do not have a client secret and will not work.

Step 2 — Register the Redirect URI

In Fastr, open Manage Protection and select the Single Sign-On (SSO) tab.
Copy the Redirect URI shown in the dialog using the copy icon: https://view.fastrworkspace.com/sso/callback
In your identity provider application, add this value to the allowed Redirect / Callback URLs and save.

Important: the Redirect URI must match exactly. A mismatch is the most common cause of login errors.

Step 3 — Enter your provider details in Fastr

Copy these three values from your identity provider application and paste them into the SSO dialog:

Issuer URL — your provider's base address. It must start with https:// (for example, https://yourcompany.okta.com). Do not add a path on the end.
Client ID — the application's identifier.
Client Secret — the application's secret. Some providers show this only once, so copy it right away.

The Redirect URI field is filled in for you — leave it as is.

Step 4 — Save and republish

Click Save.
Republish the publication and copy the new link to share.

Sharing your protected publication

When you enable protection, the publication is served from a separate secure domain, so the link is different from your previous unprotected URL. Anyone using the old link will not be able to reach the publication. After republishing, copy the new link from the Direct URL button and share that — for password protection, share it alongside the password.

Managing who has access

Password: Anyone you give the password to can view the publication.
SSO: Access is controlled in your identity provider. Anyone your provider allows to sign in to the application can view the publication. To add or remove people, or to limit access to a specific group or email domain, manage the users and assignments in your identity provider.

FAQs

Does a viewer get permanent (lifetime) access once they are allowed in?
- Answer: No. Access is session-based. After a viewer signs in, their session lasts 24 hours. Once it expires, they will need to enter the password again (Password mode) or sign in again through your identity provider (SSO mode). Access is not permanent.
Can I grant access to more than one person?
- Answer: Yes. With Password mode, share the password with everyone who needs access. With SSO, anyone your identity provider allows to sign in can view the publication — manage the list of people or groups in your identity provider.
Why is the protected URL different from my original publication URL?
- Answer: Protected publications are served from a dedicated secure domain that handles the login gate. This is why the URL changes when you enable protection. After enabling protection and republishing, share the new protected URL — for password protection, recipients will need the new link and the password together.
Can I protect a publication that's embedded on my site?
- Answer: Not at this time. Protection works only for direct-link publications shared via the Direct URL button. Embed support is planned for a future release.
Does protection affect SEO?
- Answer: Yes — SEO is automatically disabled on protected publications, because public search indexing would defeat the purpose of a login gate.
Can I still use GEO export on a protected publication?
- Answer: Yes. GEO export is a deliberate action you take to copy content where you want it, so we leave that decision in your hands. The GEO copy option remains available on protected slots. For more on GEO, see Fastr Workspace - GEO Enabled Content.
If I duplicate a slot, does the protection copy over?
- Answer: No. A duplicated slot is a brand-new slot, so protection does not carry over — just like publishing status doesn't carry over on duplicate. You'll need to set protection again on the duplicate if you want it protected.
What happens if someone tries to guess the password?
- Answer: The login page has built-in rate limiting to protect against brute-force password attempts, so your publications stay secure.
Is a downloadable PDF also protected?
- Answer: Protection applies to viewing the publication through its protected link. A downloadable PDF is delivered separately and is not currently covered by publication protection. If restricting the downloadable file is important for your use case, please contact support@getfastr.com.
Which identity providers are supported for SSO?
- Answer: Any standard OIDC provider, including Microsoft Entra, Okta, Auth0, Google, and Ping.
Can I use a password and SSO at the same time?
- Answer: No. Each publication uses one method at a time. You can switch between them at any point in Manage Protection. Switching methods signs out anyone who is currently viewing.

If you have any follow-up questions or if you need any additional assistance, please don't hesitate to reach out to support@getfastr.com.