Publish to the outside world
A page anyone can open — no login, no account
A Pro app can be published so that anybody with the link can use it: a product catalogue, a configurator, a booking form, a status lookup, a small marketing site. Visitors need no Operator account and no ERP.net user.
How it works
Pages in a Pro app each carry their own access mode. Set the home page — or the whole app — to Public and it becomes reachable to anonymous visitors. Everything after the app address is page and sub-page routing, so a public app behaves like an ordinary website. See Pages.
The rule that matters
A public page never touches your data directly. An anonymous visitor has no instance, no session and no permissions, so the app cannot query ERP, tables, files or secrets on their behalf.
Instead, you define a web request in the Backend tab and mark it public. That request runs on the server with its own stored credentials, returns only what you chose to expose, and is the only door the public page can knock on. You decide exactly what leaves the building: a price, a stock indicator, a product list — never the whole table.
The App Builder can create those requests for you, including asking you for the one secret it needs and opening the form so you only paste the value.
What you can publish today
- A catalogue or price list drawn from live data.
- A configurator that prices a combination and captures the enquiry.
- A form that writes an enquiry, booking or application back into your system.
- A status page where a customer checks an order with a reference number.
- Ordinary informational pages around any of the above.
Before you publish
- Check every public request: does it return more than a stranger should see?
- Rate and size matter — a public request is reachable by anyone.
- Keep customer-identifying data behind a reference the visitor must already know.
- Use Safe Mode while testing if a page misbehaves.
What it takes
| You want | You need |
|---|---|
| A public page | A Pro app with a page set to Public |
| Live data on that page | A public web request with stored credentials |
| A custom address | Not yet available — public apps use their Operator address today |