How to Set Up Authenticated Routes in Bubble

On every page that requires authentication, go to the Workflow tab and create a new event: Page is loaded. Add a condition: Only when Current User is logged out. Add the action: Navigation → Go to page → your login page. This redirects anyone who is not logged in to the login page immediately on page load. Add this workflow to every protected page in your app. For efficiency, you can add this check to a reusable header element that appears on all protected pages.

When redirecting to login, pass the original page URL as a parameter so users return to their intended page after logging in. Modify the redirect workflow: Go to page → login, and check 'Send more parameters to the page'. Add a parameter 'redirect' with value being the current page URL. On the login page, after a successful login workflow, check if the redirect parameter exists using Get data from page URL → redirect. If it exists, use Go to page with that URL. If not, go to the default dashboard page.

Add a 'role' field to your User Data Type (text or Option Set with values like 'admin', 'manager', 'user'). On admin-only pages, add a Page is loaded workflow with two conditions: redirect if Current User is logged out (to login), and also redirect if Current User's role is not 'admin' (to an unauthorized page or dashboard). Create a simple 'Access Denied' page that explains the user does not have permission and provides a link back to the dashboard. For more complex role hierarchies, use a number-based level system where admin = 3, manager = 2, user = 1, and check if the role level is sufficient.

Deep links are direct URLs to specific content, like a shared order page (yourapp.com/order?id=12345). When an unauthenticated user clicks such a link, they should be redirected to login and then returned to the exact same URL including parameters. Extend your redirect logic to capture the full URL including query parameters. On the login page redirect, reconstruct the full destination URL with all original parameters. Test by opening a protected deep link in an incognito window, logging in, and verifying you arrive at the intended content.

Some pages may be accessible to all logged-in users but contain sections only certain roles should see. Add conditional visibility to sensitive elements: set 'This element is visible when' to Current User's role is 'admin'. Also check 'Collapse when hidden' so the layout adjusts. For data protection, add Privacy Rules on the underlying Data Types so even if someone inspects the page source, the data is not accessible. Remember that hiding an element does not protect its data — Privacy Rules are the true security layer.