How to protect Redoc API docs with Google SSO.

Redoc Community Edition turns an OpenAPI description into readable web documentation. If teammates mainly need to browse endpoints, schemas, and examples, a private read-only viewer is simpler than a portal that also manages accounts, API keys, SDKs, and interactive requests.

• Use a viewer for internal service references and pre-release contracts
• Use a larger portal for external onboarding and API operations
• Keep the scope explicit so documentation does not become an accidental credential console

Validate the YAML or JSON document and inspect what the rendered reference will reveal. Server URLs, example payloads, security scheme descriptions, contact details, and vendor extensions can all expose internal context even when no credential is present.

• Include a clear info.title and version
• Remove real tokens, cookies, passwords, and customer identifiers
• Review server URLs and examples for the intended audience
• Publish separate specs when environments have different disclosure boundaries

internalpage validates supported OpenAPI files and can render them with ReDoc in read-only mode. ReDoc is the initial workspace default; choose it as a page override if this reference must keep that renderer even when the workspace default changes. Publish to a readable slug so the documentation can be referenced from runbooks, tickets, and service ownership records.

npx @internalpage/cli login

npx @internalpage/cli publish ./openapi.yaml --slug specs/billing-api

Choose workspace access when the API reference is useful across the company. Use selected-email access for a client, implementation partner, incident team, or pre-release review. The viewer checks permission before returning the rendered documentation.

• Workspace access for broadly used internal APIs
• Selected emails for a named review group
• A separate page when the same spec needs a different audience

Open the final URL signed out, then sign in with an authorized account. Repeat with an unrelated Google account and verify that it cannot receive the document. Check custom-domain and internalpage URLs separately if both are distributed.

• Signed-out visitors are sent to authentication
• The allowed account sees endpoints and schemas
• The denied account does not receive API content
• No public asset URL reveals the source document

Republish to the same slug whenever the contract changes. For generated specs, run the publish command after validation in CI and keep the token in the CI secret store.

npx @internalpage/cli publish ./openapi.yaml --slug specs/billing-api --json

Google SSO protects delivery but does not make secrets safe to document. Authorized viewers can inspect everything rendered in the page.