Edge basic auth for a single page only works when the challenge path, credential store, and bypass list agree. Prefer a short realm scoped to the protected URI, keep health probes and renew callbacks on an explicit allow list so a missing credential cannot take the site dark, and store secrets in the edge dictionary or secret store rather than baking them into the service config so a rotate does not force a full rewrite.

Ops prove-out after enabling the auth snippet: hit the protected path without credentials and expect a challenge, then with good credentials and expect a normal 200 body. Replay a health-probe Host that should bypass and confirm it still returns 200 while a wrong password stays challenged. Rotate one credential in the dictionary and confirm old sessions fail within one purge window; if public assets start challenging, the path match is wider than the page you meant to lock.