Strengthening App Access Control with External Access Tokens and Private Publishing

Replit has strengthened app access control with Private Publishing and External Access Tokens. Private Publishing operates at the network level, blocking unapproved requests before they reach the app, and with this update it is now available on the Core and Starter plans as well.

Until now, connecting external integrations like webhooks and callbacks required making the app public, but External Access Tokens now eliminates that trade-off. By issuing a token and handing it only to the external service that needs it, Replit verifies the request first before passing it on to the app. External services such as GitHub or Slack can also access private apps this way.

• Tokens can be scoped to either the development or production environment.
• A label and expiration date can be added at creation time, and the value can be copied only once right after issuance.
• External services can authenticate via HTTP headers (recommended) or URL query parameters.
• Tokens can be revoked instantly at any time using the trash icon.

A new External Access Tokens section has been added under Security in the Publishing panel, allowing finer-grained management of access permissions for private apps.