Trying it without SSO

DOCS_UNSAFE_DEMO_LOGIN=1
DOCS_SSO_URL=https://<your-deployment>/demo-login

— plus the two secrets from Setting it up — turns /demo-login into a persona picker that signs the same handoff token your product would. Three fake readers ship with it, one per example org plus one with none, so org isolation is visible in two clicks with nothing real behind it.

Caution

The name is the warning: this sign-in accepts anyone. Set it only on a demo or staging deployment that holds no real private content, and unset it the moment your real DOCS_SSO_URL exists. On a site with real private content, this flag makes that content readable by anyone who finds /demo-login — not only by clicking through the picker.

Use it for:

• The template’s own live preview.
• A staging site where you’re evaluating private docs before your real SSO endpoint is built.

Don’t use it anywhere holding content you wouldn’t want public.

If your org folders differ from the examples

The three personas sign orgs values that must match real folder names under src/content/org-docs/ exactly — the same contract a real token is under (see Writing private and per-org content). Edit the list in src/lib/demo-login.mjs if your staging site’s org folders don’t match acme and globex.

Exactly what this flag does and doesn’t defend against — and how someone without SSO access could still reach it — is in Private and per-org docs.