For private projects, you control which readers can access the portal by maintaining an authorized viewers list. A viewer is authorized either by their specific email address or by their entire email domain (e.g., everyone at `@yourcompany.com`).
Who can use this?
Admin only.
Accessing the viewers list
Go to Viewers > Authorized*. The page is split into two sections:
- Pending Requests — readers who requested access and are waiting for approval.
- Authorized Viewers — all currently active, inactive, or rejected viewer entries.
Adding an authorized viewer
1. On the authorized viewers page, click Add Viewer.
2. Fill in the form:
- Email— the email address or domain pattern to authorize.
- Type — select how the authorization works:
- Unique — authorizes a single email address (e.g., `john@example.com`).
- Domain — authorizes all emails from a domain (e.g., `*@example.com` authorizes everyone with an `@example.com` email).
3. Click Save.
4. A confirmation message appears: "Viewer added successfully."
The viewer is added with Active status immediately.
Approving an access request
When a reader requests access from the private portal denial page, their request appears in the Pending Requests section:
1. Review the pending request (includes the requester's email and the date of the request).
2. Click Approve to grant access.
3. A confirmation message appears: "Access approved for [email]."
4. The viewer's status changes to Active.
5. The viewer automatically receives an email notifying them that their access has been approved.
Rejecting an access request
1. In the Pending Requests section, click Reject next to the request.
2. A confirmation message appears: "Access request rejected for [email]."
3. The viewer's status changes to Not Authorized.
Rejected viewers can attempt to request access again from the portal.
Removing an authorized viewer
1. In the Authorized Viewers list, click Remove next to a viewer.
2. Confirm the removal.
3. A confirmation message appears: "Viewer removed successfully."
The viewer's record is permanently deleted. Their current browser session may remain active until they close the browser or the session expires naturally.
Limits and constraints
Each email or domain pattern can only be added once per project. Attempting to add a duplicate shows: "This email or domain is already authorized for this project."
Domain authorization uses the pattern `*@domain.com`. The asterisk wildcard covers all email addresses at that domain.
Removing a viewer does not instantly terminate their active session (they may still be able to browse until their session ends).
Access requests from the same email are not duplicated — if a request from that email already exists, no new record is created.