How to Make a Gemini Canvas Website Private

The short answer

Gemini Canvas has no password option for a shared app. Google’s Canvas safety guide says that you share Canvas apps through public links. Anyone who has the link can open the app.

To make a Gemini Canvas website private, first delete its public link. Then copy the code out of Canvas. Publish the files on a host that can put a password or an email check in front of them. Examples are Cloudflare Pages with Cloudflare Access, Netlify and Vercel. Then give your client only the new, protected URL.

How Gemini Canvas sharing works

Option	What happens	Good for
Keep the Canvas unshared	Only you see it in your Gemini chat. Your workspace rules also apply	Drafts
Create a public link	Anyone with the link can open the app	Public demos
Add a password to the public link	Not available	Use a host with access control instead
Copy the code to a protected host	Visitors need a password or an approved email address	Client review and private sharing

When you share, you open Share & export at the top of the Canvas panel and select Share. This action creates a g.co/gemini/share link (Google’s sharing steps).

Two details in Google’s safety guide are important for privacy. The first is about multi-user apps (apps that share data between users). Anyone with the public link to such an app “can view and edit all data associated with the app.” The second is about single-user apps. In an app that does not share data between users, only the person who uses the app can see or edit its data.

A public link is not private. People forward it and paste it into other documents. Chat tools also load it to make previews. Treat everything behind the link as public.

Stop sharing: delete the Canvas public link

Before you build anything new, delete the old link:

1. Go to gemini.google.com on a computer.
2. At the bottom, click Settings & help. Then click Your public links.
3. Find the link. Click Delete public link at the end of its row. Delete all links removes all public links that you made.
4. Open the old link in a private browser window. Make sure that it no longer shows the app.

Google’s public links help page has the same steps. If you delete the chat from your Gemini activity, Gemini also deletes its public link. But if you delete the link, the chat stays.

In a Google Workspace account, an administrator can control sharing. If the administrator turns sharing off, nobody can create new links. But links shared earlier keep working until they are deleted from the Gemini app. For this reason, delete them yourself.

Get the code out of Canvas

1. Open the chat that contains the Canvas.
2. Click Code at the top right of the Canvas panel to see the source.
3. Copy all of it into a new file named index.html in an empty folder.
4. If the app loads images or other files, save them into the same folder. Use the paths that the code expects.

You can also ask Gemini in the same chat: “Give me this app as a complete, self-contained index.html, with any separate files listed by path.” Compare the result with the app in the Canvas.

Before you publish anything, test the folder locally:

cd my-canvas-app
python3 -m http.server 8000

Open http://localhost:8000. Click through every screen. Make sure that the browser console shows no errors.

Look for features that used Google’s hosting of the app. The Canvas app stores the shared data of a multi-user app. This data is not in the code that you copy. As a result, the copy loses that data and the sharing between visitors. Rebuild those features with your own backend, or remove them.

Before you upload the files, remove all content that the client must not receive. Examples are API keys, personal information, internal notes and test data.

Publish the copy behind a password or email check

Select a host for the kind of gate (a login screen in front of the site) that you need.

Email codes for named people: Cloudflare Pages and Cloudflare Access

This option is the best for client work. You list the allowed addresses. Each visitor proves that they can read the inbox of an allowed address.

1. In the Cloudflare dashboard, open Workers & Pages. Select Create application, then Get started, then Drag and drop your files. Name the project and drag in the folder. Then select Deploy site (Direct Upload docs).
2. In Zero Trust, add One-time PIN as a login method under Integrations > Identity providers (One-time PIN docs).
3. Protect the site with an Access application. In its Allow policy, use Emails for specific people, or Emails ending in for a company domain.

Be careful with step 3. The Enable access policy switch in the Pages project settings protects only preview deployments. The production pages.dev address and each custom domain need their own Access configuration. Cloudflare’s Pages known issues and our Cloudflare Pages protection guide describe this configuration.

Visitors enter their email and get a code that expires after 10 minutes. With the code, they get in. Cloudflare’s Access authentication logs show which address signed in and when.

One shared password: Netlify or Vercel

On Netlify, password protection needs a paid plan. Set it under Project configuration > General > Visitor access. There, you also select if the password covers production and previews (Netlify docs, our Netlify guide).

On Vercel, Password Protection is available on the Pro and Enterprise plans. It is in the Deployment Protection settings of the project (Vercel docs).

A shared password keeps casual visitors out, but it does not tell you who opened the app. Send the password in a different message from the link.

Check the result

Open the new URL in a private window. Make sure that the password or email screen appears before any content. Then test the app on a phone and on a desktop.

When Gemini makes a new version, copy the code again. Deploy it to the same project. The protected URL stays the same, so the client keeps one link.

What protected hosting does not do

Protected hosting has three limits:

• It protects only the copy. The original Canvas link stays public until you delete it.
• It does not bring back data from a multi-user Canvas app. That data stays with the Canvas.
• It does not help with content that is already out. People who opened the public link possibly kept screenshots or copies.

Bottom line

Gemini Canvas public links are for open sharing. For an app that is only for a client or a team, delete the public link. Copy the code into a folder. Publish the folder on a host with an access gate. If you need named email addresses, use Cloudflare Pages with Cloudflare Access. If one shared password is enough, use Netlify or Vercel.

Free email addresses
for your AI agents

Each agent gets an address like myagent.x7k2@revdokumail.com. It can receive emails, send replies and store files.

• 3 free mailboxes, each with its own address
• 3,000 incoming and 500 sent emails a month
• 3 GB of storage for attachments and files
• Virus, malware, spam and prompt-injection filter
• Read and reply through API, MCP or CLI

Create free mailbox

You do not need a card.