ProtoWall Demo

Example prototype that demonstrates ProtoWall origin secret verification.

This is a fake analytics dashboard ("Acme Analytics") designed to be accessed through ProtoWall's reverse proxy. It shows how to verify that incoming requests come through ProtoWall and reject direct access.

How it works

ProtoWall sits between your users and your prototype as a reverse proxy. It injects an x-protowall-secret header on every forwarded request. Your app checks this header to ensure no one bypasses ProtoWall.

User → ProtoWall proxy (auth + NDA) → Your prototype (verifies secret)

The middleware (5 lines)

// server.js
const PROTOWALL_SECRET = process.env.PROTOWALL_SECRET;

app.use((req, res, next) => {
  if (PROTOWALL_SECRET && req.headers['x-protowall-secret'] !== PROTOWALL_SECRET) {
    return res.status(403).send('Forbidden');
  }
  next();
});

Setup

# Install dependencies
npm install

# Run locally (no secret verification)
npm run dev

# Run with secret verification
PROTOWALL_SECRET=pw_proj_your_secret_here npm start

Deploy to Render

1. Push this repo to GitHub
2. Go to Render → New Web Service → connect the repo
3. Or use the render.yaml blueprint
4. Set PROTOWALL_SECRET to your project's origin secret from the ProtoWall dashboard

Use with ProtoWall

1. Sign up at protowall.app
2. Create a project with the Render URL as the destination
3. Copy the origin secret and set it as PROTOWALL_SECRET on this service
4. Send invites — reviewers authenticate and accept the NDA through ProtoWall, then access this prototype through the proxy

Stack

• Node.js + Express
• EJS templates
• No database, no build step

License

MIT