Access & sharing
Four access levels, set per site and changeable at any time. The restricted ones work the way sharing a document does: by email address, with no account needed until the person opens the link.
The four levels
| Level | Who can open it | Search engines |
|---|---|---|
public | Anyone. | Indexed. |
unlisted | Anyone with the link. The default. | noindex |
restricted | Workspace members, plus email addresses you name. | noindex |
private | Workspace members only. | noindex |
unlisted is the default because it matches what people usually mean by “send me a link”. Set the level on publish with --visibility, or change it later on the site’s page under Access, or from an agent with PATCH /api/v1/sites/:id or the MCP set_visibility tool; a change applies on the next request. Publishing again without --visibility leaves the level alone, so a change made here survives the next publish.
Sharing a restricted site
On the site’s page, add an address under Shared with. The person does not need an account: when they open the link they are asked to sign in, and if the address they sign in with is on the list, they are let through. Google, GitHub and emailed links all work — what matters is the verified address, not the provider.
Removing an address takes effect on their next click, not when some token expires. Workspace members can always open restricted and private sites without being listed.
What happens on a restricted link
- The visitor opens
https://acme.usercontent.colophon.fyi/board-deck/. - With no proof of identity for this workspace, they are redirected to the dashboard’s sign-in gate.
- After sign-in, the gate checks their email against the site’s list and workspace membership.
- If allowed, they are sent back to the hostname they opened — the subdomain, or the workspace’s own domain — with a short-lived, signed grant cookie scoped to that origin. It lasts an hour; renewing it is a silent redirect.
- If refused, they see a “you don’t have access” page and the workspace owner is emailed that someone asked.
Choosing a level
- A report for a colleague who will open it on their phone in a hurry:
unlisted. - Something you want found:
public. - Board material for named people outside the team:
restricted, and add their addresses. - Internal notes:
private.
Restricted and private mean the reader signs in first, so use them when access control actually matters, not by default. See also Workspaces, members & keys.