# Allowed emails

Add or remove the people who can request changes, and send a test request from the agency.

## Prerequisites

- The project **Settings** page, section **Client access**.
- **Authentication** already chosen. The list is used for both **Site without login** and **App with login**.

## Steps

The block is **Who can request changes?**. An empty list denies everyone. The note is "Nobody can request changes until you add at least one person. An empty list denies everyone."

### Add someone

1. Press **Add**.
2. Type an email, or a company domain that starts with `@`. The placeholder is `sam@gmail.com or @client.com`.
3. Press **Add** again. The address appears in the list.
4. Press **Save** on **Client access**.

`@client.com` allows any email that ends with `@client.com`. A single address allows that address only. Values are stored in lowercase.

### Remove someone

1. Press the × on that person. The button name is "Remove" plus the address.
2. Press **Save**.

Until **Save**, the change stays in the form.

### Agency test

**Send a test request** is on the project header. It opens the site as the signed-in agency user for 30 minutes. The token is separate from `MODIFEE_SECRET`. The allowlist is skipped for that visit.

The widget shows "Test mode — agency" (fr: "Mode test — agence", es: "Modo de prueba — agencia"). The draft is "Change the homepage heading to Welcome". The request appears in **Inbox** with the badge **Test**, on the list and on the request.

If **Site URL** is missing, or the last widget check is unreachable, the button opens the hosted test page in the dashboard instead of the site.

## Verify

1. Save at least one address. The empty-list note disappears.
2. The mark beside **Client access** is no longer yellow for "No authorized email". **App with login** can still be yellow until the [signing secret](https://www.modifee.com/docs/vercel/signing-secret) is on Vercel.
3. From the widget, an address on the list gets a code or a signed-in session. An address off the list sees the message below.
4. Press **Send a test request**. The widget shows "Test mode — agency". **Inbox** shows **Test** on that request.

## Troubleshooting

The widget shows [MDF-AUTH-002](https://www.modifee.com/docs/errors/MDF-AUTH-002):

- English: "This email isn't allowed to request changes on this site."
- French: "Ce courriel n'est pas autorisé à demander des modifications sur ce site."
- Spanish: "Este correo no está autorizado a solicitar cambios en este sitio."

Add that email, or the company domain, then **Save**. See [Email not allowed](https://www.modifee.com/docs/troubleshooting/email-not-allowed).

- `Invalid email:` followed by the address.
- `Invalid domain:` followed by the domain.
- The domain, then "is a public email domain. Add a specific address, or a company domain such as @client.com."
- On save, the same case uses "Allow a client address or their company domain, such as @client.com."
- "That person is already on the list."
- Yellow **Client access**, tooltip "No authorized email".
- A test request that never opens the site: save **Site URL**, and fix a widget check that says the site is unreachable. [Widget not showing](https://www.modifee.com/docs/troubleshooting/widget-not-showing).