How to share a staging website behind HTTP authentication
You can share a staging website protected by HTTP authentication in Workflow by pasting the full URL—including any credentials—into a task as a live website. Password-protected sites are supported, but the site must allow iframe embedding to render correctly in Workflow.
Adding the staging site to a task
Live websites are added to Workflow by pasting a URL into a task as a creative asset. The site loads inside an embedded iframe that reviewers can interact with and comment on.
Open or create a task in your Workflow project.
Select the option to add a creative asset.
Paste your staging site URL into the URL field. For a site behind HTTP Basic Authentication, include the credentials in the URL:
https://username:[email protected].Share the task link with your reviewers so they can view and comment.
Reviewers do not need a Workflow account to view and comment on shared work—anyone with the share link can open it and leave feedback.
What to expect with HTTP authentication
Password-protected sites work in Workflow, and reviewers will need the password to access the content. For HTTP Basic Authentication, credentials can be included in the URL using the https://username:password@host format. Workflow passes through password authentication for protected sites, but cannot override your site's security policies.
If the authentication page itself has embedding restrictions—such as a restrictive Content Security Policy or X-Frame-Options header—reviewers may see a blank screen before they can reach the site content.
If the staging site won't load
Staging environments often have security headers set by the hosting platform or server that can block iframe embedding. If your staging site shows a blank page or fails to load in Workflow, check these common causes:
Cause | What to do |
|---|---|
| Remove the header or replace it with a CSP |
Content Security Policy blocks embedding | Add |
The authentication page won't render in an iframe | The auth page's own security headers prevent embedding. Adjust the headers on the auth page itself, or use an alternative review method |
For a non-technical overview of why embedded websites fail, see Why isn't my embedded website working in Workflow?. For detailed configuration steps for Apache, Nginx, and WordPress, share the How to fix embedded website issues in Workflow guide with your developer or site administrator.
Recommended staging site configuration
For review purposes, use a staging environment with relaxed security headers. At minimum, ensure the staging site allows embedding from Workflow by setting:
Content-Security-Policy: frame-ancestors 'self' *.workflow.design;Remove any X-Frame-Options header that blocks embedding, and ensure any API endpoints the site depends on allow cross-origin requests from Workflow.
Alternatives if the site cannot be embedded
If you cannot modify the staging server's security headers or the site still won't load, use Workflow's screenshot and screen recording features instead of embedding the live site. This bypasses iframe restrictions entirely and lets reviewers comment on static captures of your work.
For an overview of all supported creative formats, see What creative formats does Workflow support?. For a broader guide to sharing work with reviewers, see Sharing work.