Let Docmunk into an app that limits who can reach it
Docmunk's bots open your app from one address. If your app lets in only some addresses, as a staging site often does, add that address to its allowlist. Then check that the bots get in. The allowlist stays yours: Docmunk only tells you what your app answers.
Before you start
- The product's Address on Product › Accounts is the page the bots start at. Owners and admins can select Change to correct it.
- You can change your app's allowlist, or you know who can. It is often in the hosting provider, a firewall, or the web server.
- Your app has an address on the public internet. An app on a private network, such as one behind a VPN, has no address to allow. The bots cannot reach it this way.
1. Copy the address
On Product › Accounts, select Copy in the Bots come from row. The row shows the one address that every bot run comes from.
2. Add the address to your app's allowlist
In your app's allowlist, enter the address as an allowed address, and save it. If the allowlist asks for a range, enter the address with /32 after it.
3. Check access
On Product › Accounts, select Check access. Docmunk opens the product's Address from the same place the bots run, so your app sees the same address. Within 10 seconds it shows one answer, with the status your app gave:
| Answer | What it means | What to do |
|---|---|---|
| Reached | Your app answered with a status other than 401 or 403, such as 200. | Nothing more for the allowlist. A 404 or 500 means the app answered, but not with the page: check the Address. |
| Blocked | Your app answered 401 or 403. An allowlist or a sign-in is in the way. | Make sure the allowlist change is saved and in effect. If the app asks for a password before any page, ask whoever runs it to let the address past. |
| No answer | Nothing answered within 10 seconds. | Check the Address, and that the app is up. A firewall that drops unknown addresses gives no answer: add the address there too. |
Check access can show a message instead of an answer:
- “That address is not on the public internet”: the Address points to a private network, which the bots cannot reach this way.
- “Only ports 80 and 443 can be fetched”: the Address names another port, which Check access cannot try.