The Security settings page lets tenant admins control how members and external users access your tenant.

To open Security settings, go to Settings > Security.

Public access controls determine which surfaces can serve requests without requiring sign-in.

Three independent toggles control public access:

Public webpages. Allow webpages with public auth to serve requests without signing in. When this is on, workflows with a webpage link set to public authentication can be accessed by anyone with the URL.

External ID webpages. Allow webpages with external ID auth to serve requests without signing in. When this is on, workflows with a webpage link set to external ID authentication can be accessed without a Tines 3B account.

Public webhooks & APIs. Allow non-webpage routes with public auth to serve requests without signing in. When this is on, webhooks and API routes set to public authentication can accept requests from any caller.

When any of these are toggled off, the specified routes will require sign-in.

Public access controls are not available in the Explore edition. Self-hosted deployments may have public access disabled by a system administrator through the routeAuthForceDisabled configuration. When public access is disabled by the system, the toggles appear off and cannot be changed.

After enabling public access, configure individual workflow routes or webpages to use public or external ID authentication. Read about links, routes, and webpages to learn how to set authentication on each surface.