Protect Static HTML with Google SSO

Use internalpage when you already have a static HTML report and need a private link that coworkers can open after Google sign-in.

If you are still deciding between a private page publisher, a full application host, and an identity-aware proxy, start with the overview and decision guide. This docs page is the command reference for the internalpage path.

This is useful for:

• notebook exports
• model evaluation reports
• data quality reports
• static dashboard snapshots
• launch or release summaries

1. Prepare the HTML file

Export the report as .html or .htm.

Keep the file safe to show to every allowed viewer. Do not include API keys, database credentials, raw access tokens, or customer secrets in the HTML source.

Open the exported file locally before publishing and confirm that its charts, styles, and other embedded assets render correctly.

open ./report.html

2. Log in once

Save a personal API token with the CLI.

npx @internalpage/cli login

The CLI stores the token and reuses it for later commands.

3. Publish the private page

Publish the HTML file with a readable slug.

npx @internalpage/cli publish ./report.html --slug weekly-report

The command returns the page ID and the private viewer URL.

4. Share the viewer URL

Send the viewer URL to your team. Viewers are redirected through Google sign-in before the page is served.

Access can be workspace-wide or limited to selected emails.

5. Update the same page

When the report changes, replace the latest version instead of sending a new file.

npx @internalpage/cli publish ./report.html --slug weekly-report

The slug identifies the page. Reusing the same slug updates the existing private page and keeps its viewer URL stable.

6. Verify access before sharing broadly

Open the viewer URL in a signed-out browser and check these cases:

• Google sign-in appears before the report is delivered.
• An intended viewer can open the report.
• An account outside the configured audience cannot receive the report.
• The rendered title, charts, styles, and links match the local file.

When to use another tool

Use a full application host or a Zero Trust application proxy when the thing you need to protect is a running web app, admin UI, or staging service.

Use internalpage when the thing you need to share is a finished browser-viewable artifact such as an HTML report, Markdown document, or OpenAPI spec.