Access Control

Access control decides who can read your help center and each section, collection, and article in it. The help center itself is Public or Private, and every level below it can only narrow who gets in, never widen it.

Public and private help centers

The help center setting offers Public and Private under the heading Who can read your help center. Public means anyone can browse. Private means visitors must sign in first.

At least one visitor sign-in method must be enabled before a help center can be saved as Private. For the steps, see Make your help center private.

Visitor sign-in methods

Sign-in methods work on private help centers and on public help centers that restrict sections or collections. You can enable several methods at once, and readers see every enabled option on the sign-in page:

• Magic Links: readers enter their email and receive a one-time sign-in link. See Sign in with Magic Links.

• Single Sign-On (OIDC): readers sign in through your identity provider. See Sign in with OIDC SSO.

• Shared password: one password for all readers. Shared password readers have no individual identity, so user-group restrictions do not apply to them. See Shared password.

• Sign in with your product: readers use the account they already have in your app. See Sign in with your product.

The access hierarchy

Access narrows at each level, and no level can lift a restriction set above it:

• Help center: Public or Private sets the baseline for everything below it.

• Section: the section editor has an Access tab with three choices: Inherit, Signed-in readers, or Specific groups. The home section follows the help center setting and has no independent access.

• Collection: the same three choices as a section.

• Article: Inherit from the collection, Anyone signed in, or Specific user groups. An article can only narrow its collection's audience, never widen it.

For how to set access at each level, see Section and collection access. To restrict readers to specific groups, create the groups first: see User groups.

Locked or hidden: what readers without access see

For each section or collection you restrict, you choose what readers without access see: Inherit (the default, which resolves to hidden), Show with a lock, or Hide.

Shown with a lock

A locked section or collection keeps its title visible. The title with a lock icon appears in section tabs, the sidebar, and collection lists. Opening it shows a no-access card with your description (or the default text, such as "You don't have access to this section."), a Sign in button for signed-out readers, an optional button you configure, and Use another account for signed-in readers.

Help center search matches the locked title only. The content is never shown.

Hidden

A hidden section or collection is not listed anywhere. A direct link returns 401 for signed-out readers or 403 for signed-in readers without access, and shows the same no-access card without ever revealing the title. Unknown URLs still return 404, so hidden and nonexistent content differ only in the status code.

How restrictions combine across levels

A reader who cannot open an item may also fail the requirements of levels above it. Start at the first level the reader fails and follow the chain down to the item:

• If any level in that chain is set to Hide, the item is hidden.

• If every level in the chain is set to Show with a lock, the item shows with a lock. The lock message comes from the level closest to the item.

Two special cases:

• A requirement set on the article itself is always hidden. It never shows a lock, even when the levels above it do.

• On a Private help center, signed-out visitors see nothing at all.

Where locked and hidden content appears

Locked items appear only in help center pages. They are excluded from the widget, MCP, llms.txt, the sitemap, and RSS.

The AI assistant can mention and link a locked article by title without exposing its body. Hidden content is never mentioned, and anonymous readers are not shown group names.

Silent identify with JWT

Silent JWT identify is available on all plans in both access modes. Your backend signs a JWT so readers are identified without a separate help center login. For setup, see JWT Authentication.