Email Protection
Gate an egg behind an email allowlist — visitors sign in with a magic link sent to an allowed address or domain. No shared password to leak or rotate.
Enable it
hatch protect email enable --email you@example.com --domain @corp.com--email allows an exact address; --domain allows anyone at that domain (the leading @ is optional — @corp.com and corp.com are the same). Give at least one of either.
Manage the allowlist
hatch protect email list
hatch protect email add another@example.com @partner.com
hatch protect email remove you@example.com
hatch protect email disableadd/remove are read-modify-write against the current list — they don't replace it. Up to 200 email addresses and 50 domains per egg.
How the magic link works
A visitor enters their email; if it's on the allowlist (exact match or domain match), Hatch emails a sign-in link. The response looks identical either way — a stranger can't use it to probe who's on the list.
The link is single-use and expires after 15 min. Clicking it sets a session cookie, same as password protection. Both can be enabled at once — password protection or email protection, either alone is enough to sign in — you don't need both.
Rate limits: at most 3 magic-link sends per email every 15 min, and 30 per egg per hour across all visitors. Over the limit gets the same neutral response as everyone else.
API
POST /v1/apps/{slug}/email-protect # replace the allowlist, enable
GET /v1/apps/{slug}/email-protect # current state
DELETE /v1/apps/{slug}/email-protect # disable