Email Protection
Gate an egg behind an email allowlist — visitors sign in with a magic link sent to an allowed address or domain. No shared password to leak or rotate.
Enable it
hatch protect email enable --email you@example.com --domain @corp.com--email allows an exact address; --domain allows anyone at that domain (the leading @ is optional — @corp.com and corp.com are the same). Give at least one of either.
Manage the allowlist
hatch protect email list
hatch protect email add another@example.com @partner.com
hatch protect email remove you@example.com
hatch protect email disableadd/remove are read-modify-write against the current list — they don't replace it. Up to 200 email addresses and 50 domains per egg.
How the magic link works
A visitor enters their email; if it's on the allowlist (exact match or domain match), Hatch emails a sign-in link. The response looks identical either way — a stranger can't use it to probe who's on the list.
The link is single-use and expires after 15 min. Clicking it sets a session cookie, same as password protection. Both can be enabled at once — password protection or email protection, either alone is enough to sign in — you don't need both.
Rate limits: at most 3 magic-link sends per email every 15 min, and 30 per egg per hour across all visitors. Over the limit gets the same neutral response as everyone else.
After clicking the link, the visitor lands back on the page they originally asked for. On a device that has already signed in, the sign-in form comes prefilled with the last verified email address.
Session length
A magic-link sign-in lasts 12 h by default. Set anything from 1 h to 30 days per egg — a duration such as 90m, 12h or 7d, or default to go back to 12 h:
hatch protect email session-ttl 7d
hatch protect email session-ttl default
hatch protect email enable --email you@example.com --session-ttl 30dThe new length applies to new sign-ins; sessions already open keep their original expiry. hatch protect email list shows the current setting. Without --session-ttl, enable keeps the egg's current setting; disabling email protection resets it to the default. Like the other hatch protect email commands, these act on the egg of the current directory (.hatch.toml).
Sign everyone out
hatch protect sessions revoke [slug]Ends every visitor session of the egg at once — password and magic-link sessions alike — by rotating the egg's session secret. Visitors sign in again. The command asks you to type the egg name; pass --yes to skip the prompt (required when not run from a terminal).
Comments
Email protection is what makes Comments possible: visitors comment under the email address they signed in with. Disabling email protection also turns comments off (stored comments are kept).
MCP tools
set_email_protection (replaces the full allowlist; optional session_ttl, same values as the CLI), get_email_protection (includes session_ttl_seconds), disable_email_protection, and revoke_egg_sessions. See MCP Integration.
API
POST /v1/apps/{slug}/email-protect # replace the allowlist, enable
GET /v1/apps/{slug}/email-protect # current state
DELETE /v1/apps/{slug}/email-protect # disable
POST /v1/apps/{slug}/sessions/revoke # sign every visitor outPOST …/email-protect takes an optional session_ttl_seconds: 3600 to 2592000, 0 for the default, omitted to keep the current value.
