---
title: "A password-protected link for your client, with while.sh"
url: https://while.sh/en/guides/share-app-with-password/
author: "Aloïs Oddon, co-founder of Nextmap"
updated: 2026-11-02
---

# Show your app to a client with a link and a password, from your AI agent

Your client wants to see the app before everyone else. There's no account to create for them: a link, a password and a time limit are enough. Your AI agent sets up the access, and the password stays between you and your client.

## Prerequisites

- An app deployed on while, or a preview.
- Your AI agent, connected to while over MCP.

## Step 1: Ask your agent for access

> You, to your agent: Open the app to our client Acme for a week, with a password.

Your agent makes the app private, if it isn't already, and gives you the link to its page in while.

## Step 2: Create the link

On your app's page, you name the link and choose its duration, 1, 7 or 30 days, and its password. In production, someone who approves production deployments approves it first. Then you send the link and the password to your client, in two separate messages.

## What your agent does

Your client opens the link and enters the password: they get in without an account. The link works only for this app, until it expires, and the app stays closed to everyone else. You see how many times it was opened, and when. And after too many password attempts, the page makes the visitor wait.

## Cut off access

> You, to your agent: Cut off Acme's access.

Your agent gives you the page with your links: you revoke one in a click, and your client's next page no longer opens.

## Show a preview

> You, to your agent: Open the preview to Acme, with a password.

A link also works for a private preview: your client sees the new version before it goes to production.

## Restrict your app to your colleagues

> You, to your agent: Restrict the app to people in the company.

Your agent adds two lines to the service:

```yaml titre="while.yaml"
    access: internal
    email_domains: [acme.com]
```

Once your Google Workspace or Microsoft 365 is connected to while, on the Pro plan, your colleagues open it with their usual account, and your code receives their name and email address, with no sign-in page to write.

## Next steps

- [See every version before production](/en/guides/preview-environments/)
- [Restrict your app to the people in your company](/en/guides/internal-tool-company-sign-in/)
- [Put your app on your own domain](/en/guides/custom-domain/)

## Questions

### Does my client have to create an account?

No. The link and the password are enough.

### Does my agent see the password?

No. You choose it in while, and it stays between you and your client.

### Does the link expire?

Yes, after 1, 7 or 30 days, as you choose, and you can cut it off sooner.