Help & Documentation
Open Support Ticket

Configure Public App

A Public App is a Custom App accessible to unauthenticated visitors without signing in to Metric Insights. When an App is marked Public, all per-viewer access restrictions are removed for viewers, so anyone with the App URL can open it. Introduced in v7.2.2, the feature is intended for public-facing use cases such as an anonymous vendor signup form, a public intake form, or a read-only public listing hosted on an organization's analytics domain.

Administrators and Power Users control which Apps are Public through the Enable/Disable Public Access for Apps privilege. Individual App Datasets inside a Public App can also be marked Public so anonymous visitors can read and submit data, and an optional system variable can route unauthenticated users to a Public App that acts as a custom landing or login chooser page.

Table of Contents:

  1. Prerequisites
  2. Mark an App as Public
  3. Expose App Datasets to Anonymous Visitors
  4. Redirect Unauthenticated Users to a Public App

1. Prerequisites

The following Privileges control who can mark an App as Public. Grant them in order, because the second depends on the first.

  • Create/Edit Apps: Must be granted first; it is the parent Privilege required to edit Apps.
  • Enable/Disable Public Access for Apps: A child of Create/Edit Apps; it enables or disables public viewing access restrictions on an App. Granted to all Power Users by default. Without this Privilege, the Public App toggle is disabled.

2. Mark an App as Public

  1. Open the Custom App for editing and select the Advanced tab.
  2. Activate the Public App toggle at the top of the tab (off by default) to remove all access restrictions for viewers and expose the App to unauthenticated users.
  3. [Save]

NOTE: When the Public App toggle is on, a notice appears on the Sharing tab reading "This App is Public, no access will be applied to viewers." The "Restrict viewing to users in Access list below" setting is hidden while the App is Public.

3. Expose App Datasets to Anonymous Visitors

Marking an App Public lets anonymous visitors render it, but they cannot load or submit dataset-backed content until the underlying App Dataset is also Public. Each App Dataset carries an access type that controls who can read its rows.

  • Public: Serves all rows with no per-user filtering to both authenticated and anonymous callers. Only this access type lets unauthenticated visitors read (GET) and submit (POST) Dataset data.
  • Private: Restricts rows to their owner.
  • Managed: Applies managed per-user access control.
  • Inherited: Inherits access from the App.

To make a Dataset available anonymously, open the App Dataset in its Editor, mark the Internal Entity as an App Dataset, and set its access type to Public. The access type is available only for internal App Dataset Entities.

Anonymous visitors of a Public App Dataset may read and insert rows only. Updates and deletions are rejected for unauthenticated callers, and enumeration or management operations (User, Group, Entity metadata, access management) remain restricted to authenticated users.

NOTE: A Public App Dataset applies no row filtering and accepts anonymous inserts, so its rows are fully readable by anyone and its data accepts untrusted input. Mark a Dataset Public only when both of these are acceptable for the content it holds.

4. Redirect Unauthenticated Users to a Public App

Access Admin > System > System Variables

By default, an unauthenticated visitor who opens a protected page is sent to the standard login form. A Public App can instead serve as a custom landing or chooser page, for example one that offers both Metric Insights native sign-in and SSO/SAML links. This is controlled by the CUSTOM_APP_FOR_UNAUTHORIZED_USERS System Variable.

  1. Enter CUSTOM_APP_FOR_UNAUTHORIZED_USERS in the search field.
  2. Click the gear icon to edit the value of CUSTOM_APP_FOR_UNAUTHORIZED_USERS.
  3. Assigned Value: Enter the Name used in URL of the Public App which you want to display to unauthenticated users.
    • When empty (the default), the system behaves exactly as before and sends unauthenticated users to the standard login. When set, unauthenticated users who would be sent to login are redirected to that App at /p/<name_used_in_url>.
  4. [Save]
  5. [Commit Changes]

NOTE: The target App must be enabled and marked Public. If the referenced App does not exist or is not Public, the system falls back to the normal login redirect rather than looping. A visitor who arrived at a specific deep link still lands on that originally requested page after signing in.