# Gate an app link behind a password

> Protect a beta or private link with a password and an expiry date. The form is served at the edge, and you can remove the password later.

Page: https://warplink.app/use-cases/password-protected-app-links

Set a password on a WarpLink link and the redirect waits for it. The visitor sees a form, enters the password, and only then is sent to the app, the store page or the web page. The check runs at the edge, the stored value is a hash, and you can remove the password later.

## How it works

1. **Create the link with a password.** Add a password when you create the link in the dashboard or with the API. Pick a value you can share by message, such as one per beta group.
2. **Add an expiry when the access is short.** Set expires_at for a private beta, a press embargo or a launch preview. After that moment the link stops redirecting.
3. **Share the link and the password separately.** Send the address in one message and the password in another channel. Anyone with both can pass the gate.
4. **Know what the visitor sees.** A visitor gets a plain HTML form that works without JavaScript. A correct password returns the redirect, and a wrong one shows the form again with an error.
5. **Keep the destination through an install.** A tester without the app lands on the store page after the password, and the SDK opens the destination on first launch.
6. **Change or remove the gate.** Update the link to set a new password, or set the password to null to remove the gate. The link's history stays.

## Create a gated link, then remove the gate

### REST API (TypeScript)

```typescript
// A link that asks for a password before it redirects.
const headers = {
  // API key from Keys > API
  Authorization: "Bearer wl_live_YOUR_API_KEY",
  "Content-Type": "application/json",
};

const created = await fetch("https://api.warplink.app/v1/links", {
  method: "POST",
  headers,
  body: JSON.stringify({
    app_id: "3f9a1c2e-6b7d-4e1a-9c2f-8a5b1d0e7c44",
    slug: "beta-invite",
    destination_url: "https://app.example/beta",
    password: "choose-a-shared-password",
    expires_at: "2027-03-01T00:00:00Z",
  }),
});
const link = (await created.json()) as { id: string };

// Later: setting the password to null removes the gate.
await fetch(`https://api.warplink.app/v1/links/${link.id}`, {
  method: "PATCH",
  headers,
  body: JSON.stringify({ password: null }),
});
```

## What you get

- **Linking.** A link that holds the redirect behind a password form served at the edge, then opens the app or the store page as usual.
- **Attribution.** Installs that follow a tap on a WarpLink link, in any channel, are matched back to the link, including links that asked for a password first.
- **Analytics.** Clicks and installs for the link, so you can see how many invited testers arrived and how many installed.

## Questions

### Where is the password checked?

At the edge. WarpLink hashes the submitted password and compares it with the stored hash. Nothing about the check runs in your app, and the stored value is not the password itself.

### Does the form work without JavaScript?

Yes. The password is sent as an HTML form post, so the flow does not depend on scripts in the visitor's browser.

### Does a gated link still show a preview card?

No. A password-protected link answers all visitors, crawlers included, with the password form, so the link shows a plain address in chat apps. Use a link without a password when you want a card.

### Can I remove the password later?

Yes. Update the link and set the password to null. The link keeps its history and redirects without the form.

### Is this a good fit for a private beta?

Yes, together with an expiry date. The password limits who can pass, and the expiry ends the link when the beta ends.

## Related

- [Password protection](https://warplink.app/docs/concepts/password-protection)
- [Social previews](https://warplink.app/docs/concepts/social-previews)
- [Links API](https://warplink.app/docs/api/links)
- [Deferred deep linking](https://warplink.app/deferred-deep-linking)
- [Web-to-app smart links](https://warplink.app/use-cases/web-to-app-smart-links)