Control who can access your board

The Access & Privacy page controls who is allowed to reach your feedback portal and how they identify themselves once they do. It answers two separate questions:

1. Who can access this board? Is the portal open to everyone, or gated behind a password, an allowed list of email domains, or your own login?
2. How do visitors sign in? Once someone reaches the board, what does Sleekplan ask of them before they can vote, post, or comment?

The page is split into those two sections. This article walks through both, and shows exactly what each private mode looks like to a visitor, using a demo board at spacex.sleekplan.app.

​

Open the Access & Privacy settings

Go to Settings → Public Portal & Widget → Access & Privacy.

​

Choose who can access your board

The Who can access this board dropdown, at the top of the Board access section, is the single control that sets your portal’s front door. Pick one of five options. Selecting a gated option reveals an extra field to configure it. After any change, a save bar appears at the bottom of the page: click Save changes to make it live, or Discard to revert. The sections below cover each option, and what the visitor sees.

​

Public

Your portal and widget are open to everyone. This is the default and the right choice for public roadmaps and feature-request boards where you want the widest participation. Visitors land straight on the board with no gate, and a Sign in button in the corner lets them identify themselves when they choose to. When a board is public you still control how people sign in, using the Sign-in & posting section below.

​

Password protected

Everyone shares one password to get in. Choose Password protected, then set the shared secret in the Access password field that appears. Now anyone reaching the board is stopped by a password screen and must enter that password once to unlock it. This is the simplest way to close a board. It suits private betas or internal boards where one shared secret is enough. Anyone who has the password gets in, so share it carefully and change it when it should no longer work.

​

Restricted to email domains

Only people whose email is on a domain you approve can get in. Choose Restricted to email domains, then list the domains in the Allowed email domains field, separated by commas. Notice that the Sign-in & posting section is replaced by a short note. That is because this mode already identifies every visitor at the gate, so the separate sign-in options no longer apply. A visitor now sees an email gate that names the domains you allowed. They enter their work email to continue. To prove they own that address, they receive a short one-time code by email and enter it. Only someone who can read the inbox at an approved domain gets through. Use this when your board should be reachable by your customers or your own staff, but nobody else, and you would rather not hand out a shared password.

​

Single sign-on (JWT)

Visitors are sent to your own Sign-in URL to log in, then returned to the board with a signed token that tells Sleekplan who they are. Use this when your product already has its own login and you want those same, already-authenticated users on your board with no second sign-in. This method needs a one-time technical setup by a developer to generate the token. See the Single sign-on developer guide for how.

​

Enterprise SSO (SAML)

Every visitor is authenticated against your identity provider, such as Okta or OneLogin. Picking this option prompts you to finish the connection on the Access Management page, where you upload your provider’s SAML certificate. Open it from the button on this screen, or go to Settings → Access Management.

​

Control how people sign in

The Sign-in & posting section decides what Sleekplan asks of visitors before they vote, post, or comment. These options apply only to Public and Password protected boards, because those are the only cases where a visitor arrives without already being identified. For email domain, JWT, and SAML boards, this section is replaced by a note, since visitors are identified the moment they pass the gate.

​

Force single sign-on

When Force single sign-on is on, visitors must sign in through your app before they can do anything on the board. Turning it on reveals a Sign-in URL field, where you point Sleekplan at your login page, and it hides the individual sign-in toggles below, because your app now owns identity. Leave it off if you want Sleekplan to handle sign-in itself, using the three toggles below.

​

Anonymous voting & posting

Let people vote, post, and comment without giving an email address at all. Turn this on to remove every barrier and collect the most feedback, at the cost of not knowing who left it. Turn it off to require an identity (an email) before anyone can contribute.

​

Require email verification on registration

When on, a new user must confirm their email address the first time they register. This keeps fake or mistyped addresses out of your user list. It applies once, at registration.

​

Require email confirmation on sign-in

When on, Sleekplan emails a one-time code every time a returning user signs in, so only someone with access to the inbox can post as that person. To understand how these accounts work and why your end users never create a Sleekplan login, see How Sleekplan handles end-user accounts. For the one-time codes and confirmation messages these options trigger, see Emails Sleekplan sends to your users.

​

Save your changes

Every change on this page is a draft until you save it. Whenever you have unsaved edits, a bar appears at the bottom reading “Unsaved changes. Your edits aren’t live yet.” with Discard and Save changes buttons. Your board keeps its current access rules until you click Save changes, so you can switch modes and fill in a password or domains without locking anyone out mid-edit.

​

Next steps