Basic authentication
HTTP basic authentication requires a username and password before Caddy forwards a request to an application. Coolify can generate the required Caddy label and bcrypt hash for standard applications.
HTTP basic authentication protects a route with one shared credential. It does not replace application accounts, role-based access, multi-factor authentication, or single sign-on.
Protect a resource
Choose the path that matches how the resource is deployed.
Automatic
Open the application settings
Open the application, select Configuration > General, then find HTTP Basic Authentication.
Add the credentials
Enable HTTP Basic Authentication, then enter a Username and Password. Save the application settings.
Coolify hashes the password and adds a caddy_<index>.basicauth.<username> label for each generated Caddy route.
Redeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.
Manual
Generate credentials
Generate a bcrypt hash with the Caddy CLI:
caddy hash-password --plaintext '<password>'Add the label
Open the application General page, find Container Labels, then disable Readonly labels. Add one basicauth label matching the index Coolify already generated for you domain:
caddy_0.basicauth.<username>="<bcrypt-hash>"
caddy_0.encode=zstd gzip
caddy_0.handle.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=https://domain.com
caddy_ingress_network=coolifyRedeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.