Docs / Editing

Give someone access

There are no accounts. Anyone with the staging address and the password can edit, and nobody needs a GitHub login.

Invite someone

1. Send them the staging address with ?edit on the end.
2. Send them the password separately, for example by text message rather than in the same email.
3. Send them the editing guide.

End someone's access

Change EDIT_PASSWORD on your host and redeploy staging. Every browser that was signed in is signed out, because the login is tied to the password. Then give the new password to the people who should keep editing.

What they can and can't do

• They can change words on the staging site. Layout, styles and scripts can't be edited.
• Their saves go to the staging branch. Nothing reaches your live site until you merge staging into your main branch.
• Every save is a commit, so you can see exactly what changed and undo it. See Saving and history.

How the login is protected

• The editor only exists where all four required settings are set, and only on EDIT_HOST. Production has none of them.
• The password is checked on your host, then the browser keeps a secure, HttpOnly cookie for 30 days. Wrong passwords are slowed down, so use a long one.
• The GitHub token never leaves your host. Give it access to the one repo, with Contents only.
• Edited text is cleaned before it's written: no scripts, event handlers, inline styles or javascript: links.