Skip to content
VegaStack
All docs
Sharing

Public links

Sharing a resource publicly — permission, password, expiry, indexing.

Updated 2026-05-25

Public links

A public link makes a page visible to the public web. It's a per-resource setting (public_access), not a separate object — turning it off does not delete the source, and the page is served live (the same rendered HTML members see), so it always reflects the latest save.

The public URL is the page's normal URL — /<workspace-slug>/p/<page-slug>-<id> — the same address members use. Signed-in members get the editor; signed-out visitors and non-members get the read-only public view when the page's effective public level allows it, and a uniform 404 when it doesn't (so links can't be enumerated).

Open the Share sheet from the page actions menu and find the "Anyone with the link" section. Set:

  • Level — Off, Can view, or Can comment.
  • Password — optional; sets a cookie-backed gate.
  • Expiry — optional; after the date passes the URL returns 404.
  • Allow search engines — a page-only toggle (public_indexing) that drives the page's robots meta and its inclusion in the sitemap. A page is crawlable only when it is both effectively public and opted in. Making a space or folder public makes its pages publicly viewable but never crawlable on their own — a space/folder has no public URL — so the indexing toggle appears only on pages.

When the link is on, the sheet shows the copyable canonical URL. Public access is resolved live from the per-resource public_access columns over the page's path (most-specific-wins) — there is no cached copy, so a change takes effect on the very next request. A page can override the level set on its space or folder — turning a public folder's page back Off keeps that page private. Only editor+ (and admins) can change these settings; viewers and commenters see them read-only but can still copy the link.

Password gate

When a password is set, the public URL serves an HTML form instead of the page. The form POSTs to /api/share/<resourceType>/<resourceId>/unlock. Submitting the correct password sets an httpOnly vegastack_share_password cookie holding a token that unlocks that specific resource (path /, 30-day lifetime). The token is re-verified on every request before the page renders.

Expiry and turning off

An expired or turned-off public link makes the URL return 404 — to a visitor the page simply appears not to exist. The effective public state is re-checked on every request (it is never cached), so a change takes effect immediately; no cache purge is involved. Both transitions emit an audit event (resource.public.change).

Comments on public pages

When the page's effective public level is comment, the public view mounts the same comment experience members use: visitors select text to anchor a comment, author it in a markdown composer (bold, italic, code, lists, links — rendered identically to member comments), and reply within threads shown as inline highlights. A visitor signed in to another workspace comments under their account name automatically; an anonymous visitor enters a display name once (defaulting to "Guest user"). The view level renders the page read-only with no comment affordance.

A public page carries a search box that POSTs to /api/public/search?pageId=<id>&q=<query>. The search is scoped to that page only and respects the same password and expiry checks as the page itself.