Allowed emails

Prerequisites

• The project Settings page, section Client access.
• Authentication already chosen. The list is used for both Site without login and App with login.

Steps

The block is Who can request changes?. An empty list denies everyone. The note is "Nobody can request changes until you add at least one person. An empty list denies everyone."

Add someone

1. Press Add.
2. Type an email, or a company domain that starts with @. The placeholder is sam@gmail.com or @client.com.
3. Press Add again. The address appears in the list.
4. Press Save on Client access.

@client.com allows any email that ends with @client.com. A single address allows that address only. Values are stored in lowercase.

Remove someone

1. Press the × on that person. The button name is "Remove" plus the address.
2. Press Save.

Until Save, the change stays in the form.

Agency test

Send a test request is on the project header. It opens the site as the signed-in agency user for 30 minutes. The token is separate from MODIFEE_SECRET. The allowlist is skipped for that visit.

The widget shows "Test mode — agency" (fr: "Mode test — agence", es: "Modo de prueba — agencia"). The draft is "Change the homepage heading to Welcome". The request appears in Inbox with the badge Test, on the list and on the request.

If Site URL is missing, or the last widget check is unreachable, the button opens the hosted test page in the dashboard instead of the site.

Verify

1. Save at least one address. The empty-list note disappears.
2. The mark beside Client access is no longer yellow for "No authorized email". App with login can still be yellow until the signing secret is on Vercel.
3. From the widget, an address on the list gets a code or a signed-in session. An address off the list sees the message below.
4. Press Send a test request. The widget shows "Test mode — agency". Inbox shows Test on that request.

Troubleshooting

The widget shows MDF-AUTH-002:

• English: "This email isn't allowed to request changes on this site."
• French: "Ce courriel n'est pas autorisé à demander des modifications sur ce site."
• Spanish: "Este correo no está autorizado a solicitar cambios en este sitio."

Add that email, or the company domain, then Save. See Email not allowed.

• Invalid email: followed by the address.
• Invalid domain: followed by the domain.
• The domain, then "is a public email domain. Add a specific address, or a company domain such as @client.com."
• On save, the same case uses "Allow a client address or their company domain, such as @client.com."
• "That person is already on the list."
• Yellow Client access, tooltip "No authorized email".
• A test request that never opens the site: save Site URL, and fix a widget check that says the site is unreachable. Widget not showing.