Access Control
Access control decides whether your help center is open to everyone or only available after sign-in.
Choose Open if anyone should be able to browse. Choose Locked if visitors must sign in first. Collections and articles follow that default unless you restrict them further.
Private help centers, user groups, and audience controls require a Scale or Enterprise plan.
User Identification
JWT Identify is available on all plans in both Open and Locked modes. Your backend signs a JWT so users are identified without a separate help center login.
Generating a JWT secret in Access Control enables this method.
See JWT Authentication for setup. Related: Use Ferndesk with AI tools and Let readers use your help center in AI tools.
JWT secret generation, rotation, and reveal do not require the help center authentication paid feature.
Visitor Sign-In
When your help center is locked, configure at least one sign-in method. You can enable multiple methods and users will see all options on the sign-in page. Locked mode and the following methods require a Scale or Enterprise plan.
Magic Links: Users enter their email and receive a one-time sign-in link. Set up Magic Links.
Single Sign-On (OIDC): Connect an identity provider like Okta, Auth0, or Google Workspace so users sign in through your existing system. Set up OIDC SSO.
Shared Password: One password for all users. Shared password users have no individual identity, so user-group restrictions do not apply. Set up Shared Password.
Audience Hierarchy
Access flows from help center to collection to article, narrowing at each level:
Help center: Open or Locked sets the baseline.
Collection: Follows the help center's mode by default. You can restrict to signed-in users or specific groups.
Article: Can only narrow the collection's audience, never widen it.
Use collections to set broad access rules, then restrict individual articles as needed. For managing which users belong to which groups, see User groups.