Basic authentication
HTTP basic authentication requires a username and password before Traefik forwards a request to a resource. Coolify can generate the required Traefik middleware labels for standard applications. Docker Compose applications and services use labels in their Compose file.
HTTP basic authentication protects a route with one shared credential. It does not replace application accounts, role-based access, multi-factor authentication, or single sign-on.
Protect a resource
Choose the path that matches how the resource is deployed.
Automatic
Coolify hashes the password and generates the Traefik middleware when you enable the built-in setting.
Open the application settings
Open the application, select Configuration > General, then find HTTP Basic Authentication.
Add the credentials
Enable HTTP Basic Authentication, then enter a Username and Password. Save the application settings.
Keep Readonly labels enabled so Coolify continues to generate the proxy labels.
Redeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.
Manual
Generate credentials
Generate a bcrypt credential with htpasswd. On Debian or Ubuntu, the command is provided by the apache2-utils package:
htpasswd -nbB <username> '<password>'Add the labels
Open the application General page, find Container Labels, then disable Readonly labels. Basic authentication takes two labels: one that defines the middleware and one that attaches it to the HTTPS router.
traefik.enable=true
traefik.http.middlewares.http-basic-auth.basicauth.users=<username>:<bcrypt-hash>
traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
traefik.http.routers.http-0-<uuid>.entryPoints=http
traefik.http.routers.http-0-<uuid>.middlewares=redirect-to-https
traefik.http.routers.http-0-<uuid>.rule=Host(`domain.com`) && PathPrefix(`/`)
traefik.http.routers.http-0-<uuid>.service=http-0-<uuid>
traefik.http.routers.https-0-<uuid>.entryPoints=https
traefik.http.routers.https-0-<uuid>.middlewares=http-basic-auth
traefik.http.routers.https-0-<uuid>.rule=Host(`domain.com`) && PathPrefix(`/`)
traefik.http.routers.https-0-<uuid>.service=https-0-<uuid>
traefik.http.routers.https-0-<uuid>.tls.certresolver=letsencrypt
traefik.http.routers.https-0-<uuid>.tls=true
traefik.http.services.http-0-<uuid>.loadbalancer.server.port=3000
traefik.http.services.https-0-<uuid>.loadbalancer.server.port=3000If the HTTPS router already lists middleware such as gzip, append ,http-basic-auth to the existing comma-separated value instead of replacing it.
See Custom middlewares for what disabling Readonly labels makes you responsible for.
Redeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.
Use only the htpasswd output in the Traefik label. Store the plaintext password in a password manager and rotate it by replacing the hash and redeploying the resource.