Basic authentication
HTTP basic authentication requires a username and password before Caddy forwards a request to an application. Coolify can generate the required Caddy label and bcrypt hash for standard applications.
HTTP basic authentication protects a route with one shared credential. It does not replace application accounts, role-based access, multi-factor authentication, or single sign-on.
Protect a resource
Choose the path that matches how the resource is deployed.
Automatic
Open the application settings
Open the application, select General, then find Security > Authentication.
Add the credentials
Choose HTTP Basic Authentication in Authentication, then enter a Username and Password. Save the application settings.
Coolify hashes the password and adds a caddy_<index>.basicauth.<username> label for each generated Caddy route.
Redeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.
Manual
Generate credentials
Generate a bcrypt hash with the Caddy CLI:
caddy hash-password --plaintext '<password>'Add the label
Open the application General page, find Container labels, then set Label management to Managed manually (edit labels yourself). Add one basicauth label matching the index Coolify already generated for you domain:
caddy_0.basicauth.<username>="<bcrypt-hash>"
caddy_0.encode=zstd gzip
caddy_0.handle.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=https://domain.com
caddy_ingress_network=coolifyRedeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.