How to protect static HTML with Google SSO.

Google sign-in answers who the viewer is; the page access policy decides whether that identity may receive the HTML. This is different from adding a Google login button to a public static host, where the original file may still be reachable outside the application route.

• The source file remains private until the viewer passes the configured access check
• Workspace access is useful for team-wide reports
• Selected-email access is useful for a smaller review group

Authorized viewers can inspect the HTML delivered to their browser. Never embed credentials, API keys, or secrets in the report source.

Export the report from your notebook, script, dashboard tool, or agent workflow. A self-contained file is the most predictable option because CSS, images, and scripts do not depend on a separate public asset host.

• Use .html or .htm for static reports
• Open the file locally once to confirm that charts and styles render
• Remove credentials, private tokens, raw customer secrets, and unnecessary personal data

open ./report.html

Use the dashboard for an occasional report, or use the CLI when a script or recurring workflow generates the file. The first publish creates the page; later publishes to the same slug update it without changing the shared URL.

• Dashboard publishing works for manual reports
• CLI publishing works for repeatable scripts and CI
• A readable slug such as weekly-report makes the destination recognizable

npx @internalpage/cli login

npx @internalpage/cli publish ./report.html --slug weekly-report

Choose workspace access when every signed-in member should see the report, or grant selected emails when the audience is narrower. Test the final viewer URL from a signed-out browser before distributing it.

• Unauthenticated viewers go through Google sign-in
• Unauthorized viewers do not receive the page content
• The intended Google account can open the report after sign-in

Regenerate the local file and publish it again with the same slug. This replaces the current version behind the existing private link, so teammates do not need a new attachment or bookmark.

• Keep the slug stable for recurring reports
• Use a different slug when the report needs a separate audience or lifecycle
• Review recent view logs when you need to confirm access

npx @internalpage/cli publish ./report.html --slug weekly-report

A private static page is a good fit for read-only output. Use an application platform when the browser needs to write to a database, call a private backend continuously, or support complex interactive sessions.

• Use Cloudflare Access when you already operate an application or hostname
• Use a full application host for server-side logic and live data writes
• Use internalpage when the deliverable is the finished HTML file itself