export declare const authenticationMdxTemplate = "---\ntitle: \"Authentication\"\ndescription: \"Password protect your documentation site with a single environment variable that gates pages, content APIs, and search crawlers behind a shared password.\"\ndate: \"2026-07-01\"\ncategory: \"Deployment\"\ncategoryOrder: 4\norder: 2\n---\n# Authentication\n\nKeep your documentation private by putting the whole site behind a shared password. Set one environment variable and Doccupine gates every page behind a login screen, blocks the content APIs, and hides the site from search engines - no accounts, no database, no extra services.\n\n## Enabling password protection\n\nSet `SITE_PASSWORD` in your environment (for local development, add it to `.env`):\n\n```bash\nSITE_PASSWORD=choose-a-strong-shared-password\n```\n\nThat is the only setting. Everyone who visits the site shares this single password.\n\n<Callout type=\"note\">\n  When `SITE_PASSWORD` is unset or empty, the site is fully public and behaves exactly as before. Removing the variable turns protection off again.\n</Callout>\n\n## What gets protected\n\nWhile a password is set, protection is enforced across three layers:\n\n- **Pages**: Every page renders a login screen instead of your documentation until the visitor enters the correct password.\n- **Content APIs**: The AI chat (`/api/rag`), search (`/api/search`), and [API playground](/api-playground) proxy (`/api/playground`) endpoints return `401 Unauthorized` without a valid session. The docs cannot be scraped around the login screen, and the proxy cannot be used to relay requests on behalf of an anonymous visitor. Each route re-checks the session itself, so a direct invocation is refused even when it does not pass through the middleware.\n- **Search engines and crawlers**: `robots.txt` disallows all crawlers, every page ships a `noindex, nofollow` meta tag, and responses carry an `X-Robots-Tag: noindex, nofollow` header.\n\n<Callout type=\"note\">\n  The [MCP server](/model-context-protocol) uses `DOCS_API_KEY` bearer authentication when that variable is set. Otherwise, a password-protected site requires the normal gate session for MCP too, so the endpoint cannot bypass `SITE_PASSWORD`.\n</Callout>\n\nThe AI endpoint also supports `RAG_API_KEY` for authenticated server-to-server access on public sites. Because the browser cannot safely hold that secret, use `SITE_PASSWORD` rather than `RAG_API_KEY` when authenticated browser visitors should use the built-in assistant.\n\n## How it works\n\nWhen a visitor submits the correct password, Doccupine sets a signed, `httpOnly` cookie that unlocks the site for 30 days. The cookie never stores the password itself - it holds an HMAC derived from it - and it is checked in constant time to avoid leaking information through timing.\n\nBecause the check reads `SITE_PASSWORD` at request time, you can turn protection on or off by changing the environment variable and redeploying. No rebuild of your content is required.\n\n## Security notes\n\n- **Use a strong password.** It is shared by everyone with access, so treat it like any other shared secret and rotate it when needed.\n- **Serve over HTTPS in production.** The session cookie is marked `secure` in production, so it is only sent over encrypted connections.\n- **Brute-force protection.** On recognized hosting platforms, password attempts are rate limited by the platform's trusted client address. Unknown and self-hosted proxy setups use one shared fallback bucket rather than trusting a spoofable forwarding header; configure a trusted edge limiter for accurate per-client limits there.\n- **Rotating the password.** Changing `SITE_PASSWORD` invalidates every existing session immediately - visitors will need to enter the new password.\n\n<Callout type=\"warning\">\n  A shared password is meant for lightweight gating - private previews, internal docs, or work-in-progress sites. For per-user access control or audit trails, put the site behind your own identity provider or a hosting platform's access controls.\n</Callout>\n\n## Behavior\n\n- **Runtime toggle**: Protection is controlled entirely by the `SITE_PASSWORD` environment variable, evaluated on each request.\n- **Graceful default**: With no password set, nothing changes - the site stays public and fully indexable.\n- **Session length**: A successful login lasts 30 days before the visitor is asked to sign in again.\n\n## Example\n\nProtect a staging deployment while it is being reviewed:\n\n```bash\nSITE_PASSWORD=preview-2026\nNEXT_PUBLIC_SITE_URL=https://staging.example.com\n```\n\nWhen you are ready to launch publicly, remove `SITE_PASSWORD` and redeploy. The login screen disappears, crawlers are welcomed back, and your [sitemap](/deployment-and-hosting) is advertised again.";