# How to deploy / build Cumulocity web app with public /anonymous access **URL:** \ **Category:** Forum\ **Tags:** web-development, c8y-webSDK, app-enablement\ **Created:** [June 30, 2026, 12:54pm UTC](https://community.cumulocity.com/t/how-to-deploy-build-cumulocity-web-app-with-public-anonymous-access/14997 "2026-06-30T12:54:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Christof\_Strack](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christof_strack/32/30066_2.png) [@Christof\_Strack](https://community.cumulocity.com/u/Christof_Strack)\ **Post date:** [June 30, 2026, 12:54pm UTC](https://community.cumulocity.com/t/how-to-deploy-build-cumulocity-web-app-with-public-anonymous-access/14997/1 "2026-06-30T12:54:29Z")
Hi, I would like to deploy an app to Cumulocity containing documentation, openapi spec for user without requiring authentication. How can I achieve this? P.S. the [link](https://cumulocity.com/guides/web/tutorials/#remove-login-and-authentication) found in another topic isn’t valid any longer. –Christof ---
**Author:** ![Tristan\_Bastian](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/tristan_bastian/32/18259_2.png) [@Tristan\_Bastian](https://community.cumulocity.com/u/Tristan_Bastian)\ **Post date:** [June 30, 2026, 1:20pm UTC](https://community.cumulocity.com/t/how-to-deploy-build-cumulocity-web-app-with-public-anonymous-access/14997/2 "2026-06-30T13:20:48Z")
Hi @Christof_Strack, The documentation of the 2024 yearly release still covers what you have linked: [Tutorials - Cumulocity Release 2024 documentation](https://cumulocity.com/docs/2024/web/tutorials/#remove-login-and-authentication) But there is actually no need for a hardcoded user in case you do not want to interact with any APIs of Cumulocity. In case you want to use the Web SDK for that application there is a `noLogin` application option (see: [codex](https://cumulocity.com/codex/advanced-development/services/options-service/overview)) that will stop redirecting you to the login app in case that app is opened directly. To be honest your usecase is not really clear to me, why would you want to show a user the OpenAPI spec if he is unable to login and actually use these APIs? And for logged in users there is already a solution to view the OpenAPI spec exposed by microservices: > **[GitHub - Cumulocity-IoT/api-doc: A repository containing the latest sources of the...](https://github.com/Cumulocity-IoT/api-doc)** > > A repository containing the latest sources of the Cumulocity Web SDK based "api-doc" application. It also allows to compare the differences between Web SDK versions for this application easily. To quickly get started using the Web SDK, this application can also be just forked instead of the usualy scaffolding approach. Regards, Tristan ---
**Author:** ![Christof\_Strack](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christof_strack/32/30066_2.png) [@Christof\_Strack](https://community.cumulocity.com/u/Christof_Strack)\ **Post date:** [June 30, 2026, 2:57pm UTC](https://community.cumulocity.com/t/how-to-deploy-build-cumulocity-web-app-with-public-anonymous-access/14997/3 "2026-06-30T14:57:32Z")
> [@Tristan\_Bastian](#): > > To be honest your usecase is not really clear to me, why would you want to show a user the OpenAPI spec if he is unable to login and actually use these APIs? The customer wants to host OpenAPI specs: 1. for customs applications deployed as Cumulocity Microservice 2. for external applications not deployed as Cumulocity Microservice These OpenAPI specs should be accessible for client applications/ developers without authentication. –Christof ---
**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\ **Post date:** [July 1, 2026, 5:54am UTC](https://community.cumulocity.com/t/how-to-deploy-build-cumulocity-web-app-with-public-anonymous-access/14997/4 "2026-07-01T05:54:59Z")
As we still have the policy thate all microservices requests (in your case mainly GET Requests) must be authenticated, this is currently not possible. The only way can think of by hardcoding an user in a webapp which has ONLY access to this microservice and OpenAPI endpoints (must be implemented and checked by the microservice) as a kind of proxy. User → proxy Web App with hardcoded user → Microservice endpoint of Open API.