# Add an app hosted elsewhere

Most teams already have an internal tool running somewhere before they ever
touch Volly. You don't need to rebuild it to bring it in. **External URL
apps** let that tool stay exactly where it is: Volly just adds a place for it
in your company directory and a sign-in gate so only your workspace can
reach it.

Building something new instead, and it just needs to read from a company
database or call an internal API? Use [external resources](https://volly.so/docs/external-resources)
— no gating required there.

Once it's set up, your team opens the app at a normal Volly address like
`https://acme-reports.volly.so`, signs in with their work account, and Volly
passes their requests through to your server.

## How it stays secure

Your server is still on the open internet; Volly doesn't hide it. Instead,
it attaches a signed, short-lived token (the `X-Volly-Jwt` header) to every
request it forwards, proving the visitor is a signed-in member of your
workspace. **Your app has to check that token and reject anything without a
valid one.** That check is the whole thing keeping strangers out, so Volly
won't switch the app on until it's confirmed the check actually works.

It sounds like a lot, but it's a few lines of code, and you don't have to
write them from scratch (see below).

:::caution
Because the origin server stays publicly reachable, you'll need to make a
code change to your application so it only accepts traffic coming through
Volly.
:::

## Set it up

1. **Create the project.** In the publish wizard, choose **External URL**
   and enter where the tool is hosted (an `https://` address). You'll also
   pick a short reason it lives outside Volly, which helps us improve
   hosting support over time.
2. **Add the token check to your app.** The app needs to reject any request
   whose token isn't valid. There's an example repo,
   [`volly-app/example-gated-verification`](https://github.com/volly-app/example-gated-verification),
   with working verification code and an agent skill that wires it into your
   project for you.
3. **Run the check.** On the project page, click **Run origin check**. Volly
   probes your server four ways: it rejects requests with no token, rejects
   expired tokens, rejects tokens minted for a different app, and accepts a
   valid one.

When all four pass, the app goes live in your directory. If any fail, the
page shows which ones so you can fix them and run it again. Until then,
visitors see a "Not available yet" page and Volly serves nothing.

## Good to know

- **Changing the hosted URL re-runs the gate.** Point the app at a different
  address and it switches off until the new one passes the check.
- **Your app knows who's visiting.** The token carries the signed-in
  viewer's email, so your tool can show per-person content without running
  its own login system.
- **No uploads, no drafts.** External URL apps have nothing deployed on
  Volly. Updates happen wherever the app is actually hosted.