diff --git a/api/services/app_service.py b/api/services/app_service.py
index 1fd7cb5e33..59a917d4fd 100644
--- a/api/services/app_service.py
+++ b/api/services/app_service.py
@@ -12,8 +12,10 @@ from core.agent.entities import AgentToolEntity
 from core.app.features.rate_limiting import RateLimit
 from core.errors.error import LLMBadRequestError, ProviderTokenNotInitError
 from core.model_manager import ModelManager
-from core.model_runtime.entities.model_entities import ModelPropertyKey, ModelType
-from core.model_runtime.model_providers.__base.large_language_model import LargeLanguageModel
+from core.model_runtime.entities.model_entities import (ModelPropertyKey,
+                                                        ModelType)
+from core.model_runtime.model_providers.__base.large_language_model import \
+    LargeLanguageModel
 from core.tools.tool_manager import ToolManager
 from core.tools.utils.configuration import ToolParameterConfigurationManager
 from events.app_event import app_was_created
@@ -21,8 +23,11 @@ from extensions.ext_database import db
 from models.account import Account
 from models.model import App, AppMode, AppModelConfig
 from models.tools import ApiToolProvider
+from services.enterprise.enterprise_service import EnterpriseService
+from services.feature_service import FeatureService
 from services.tag_service import TagService
-from tasks.remove_app_and_related_data_task import remove_app_and_related_data_task
+from tasks.remove_app_and_related_data_task import \
+    remove_app_and_related_data_task
 
 
 class AppService:
@@ -152,6 +157,10 @@ class AppService:
 
         app_was_created.send(app, account=account)
 
+        if FeatureService.get_system_features().webapp_auth.enabled:
+            # update web app setting as private
+            EnterpriseService.update_app_access_mode(app.id, "private")
+
         return app
 
     def get_app(self, app: App) -> App:
diff --git a/api/services/enterprise/enterprise_service.py b/api/services/enterprise/enterprise_service.py
index 21e4831715..c1fccd0dff 100644
--- a/api/services/enterprise/enterprise_service.py
+++ b/api/services/enterprise/enterprise_service.py
@@ -42,3 +42,19 @@ class EnterpriseService:
         if not data:
             raise ValueError("No data found.")
         return WebAppSettings(**data)
+
+    @classmethod
+    def update_app_access_mode(cls, app_id: str, access_mode: str) -> bool:
+        if not app_id:
+            raise ValueError("app_id must be provided.")
+        if access_mode not in ["public", "private", "private_all"]:
+            raise ValueError("access_mode must be either 'public', 'private', or 'private_all'")
+
+        data = {
+            "appId": app_id,
+            "accessMode": access_mode
+        }
+
+        response = EnterpriseRequest.send_request("POST", "/webapp/access-mode", json=data)
+
+        return response.get("result", False)