Core Concepts
What does Keelson do?
Section titled “What does Keelson do?”Keelson is a runtime platform for securely publishing applications that are shared within an organization or team.
You can focus on developing the application itself while Keelson handles the systems required to publish, authenticate, and share it. This page explains how those responsibilities are divided.
How does a request reach an application?
Section titled “How does a request reach an application?”A user’s browser does not connect directly to an application deployed on Keelson. Every request passes through the Keelson Proxy first.
What happens behind the scenes?
Section titled “What happens behind the scenes?”When a user opens the URL of an application deployed on Keelson, the request is processed in this order:
- Keelson identifies the application associated with the public URL.
- The Keelson Proxy checks whether the user is logged in.
- Keelson checks whether the user has permission to access the application.
- Only an authorized request is forwarded to the application.
- The application’s response is returned to the user.
The important point is that authentication and access-control decisions happen outside the application itself. Application developers can therefore publish applications intended for sharing without building a login screen or session management from scratch each time.
Keelson separates authentication and access control from the application. The application can concentrate on business logic, while the platform applies security consistently when the application is shared.
Why does the application not need to implement authentication?
Section titled “Why does the application not need to implement authentication?”Login protection is enabled as soon as an application is deployed to Keelson. We call this Security by Default.
- Security is built in from the beginning instead of added later.
- The application is protected when it is published, rather than requiring authentication to be added after it works.
- The login screen shown in a private browser window during the Quickstart is the result of this protection.
This is why Keelson is more than application hosting: it is a runtime platform for internal applications.
Keelson provides login protection and access control at the application’s entry point. If an application needs additional controls based on its own business rules, implement those controls within the application.
Division of responsibilities
Section titled “Division of responsibilities”When you use Keelson, the boundary between the application developer’s responsibilities and Keelson’s responsibilities is clear.
| The application provides | Keelson provides |
|---|---|
| User interface | Deployment environment |
| Business logic | Public URL |
| API | Login protection |
| Data processing | Access control for the application |
| Runtime environment management |
With this division, application developers do not need to spend time building infrastructure or platform-level security.
Why is Keelson suited to internal and team applications?
Section titled “Why is Keelson suited to internal and team applications?”Keelson is not a platform for applications used locally by only one person. It is designed for secure sharing within a team or organization.
The platform therefore includes these features:
- Public URL — deploying an application gives you a URL that you can share with your team.
- Login protection — only authorized members can access the application.
- Member management — control who can access each application.
Learn more on these pages:
Run the application first, then add configuration as needed
Section titled “Run the application first, then add configuration as needed”At first, you only need to focus on deploying and running the application.
You can configure Keelson incrementally. The experience covered in the Quickstart is the entry point with minimal configuration. Add settings such as these when you need them:
- keelson.yaml Reference — detailed application configuration
- Environment Variables — runtime configuration values
- Custom Domains — assign your own domain
- IP Allowlist — restrict access by source IP address