Basic Auth for the API Explorer Protect the Mockzilla API Explorer UI with HTTP Basic Auth. Only the explorer is gated (home, .services, .history, .replay, .config). Your mock API endpoints stay open. Enable Via environment variables: MOCKZILLA_BASIC_AUTH_USER=alice MOCKZILLA_BASIC_AUTH_PASSWORD=s3cret or in app.yml: basicAuth: user: alice password: s3cret Leave them unset to keep the explorer open (the default). Notes

• Pre-hashed passwords: set MOCKZILLA_BASIC_AUTH_PASSWORD_HASH (SHA-256 hex) instead of plaintext so the secret never travels in cleartext. The hash wins when both are set. Generate one with echo -n 's3cret' | shasum -a 256.
• Credentials are compared in constant time.
• Portable mode now reads .env from the working directory, so these variables (and any other config) can live in a .env next to the binary, matching server mode.