Share a private site with access codes
Create limited-use Pro access codes, check visitor access, and revoke them when needed.
Create codes
Access codes require an active Pro plan. Open a project’s sharing controls, set Access to Invite only, and find Access codes. Choose how many codes to create (1–100), their lifetime (1–720 hours) and allowed redemptions per code (1–100).
Copy the codes when they appear. Full codes are shown only once; the owner list retains their last four characters, redemption count, expiry and revocation status. Keep the copied codes private. An owner can maintain up to 1,000 unexpired, unrevoked codes per project; code creation is rate limited.
Check the visitor flow
Send the visitor the project’s normal public address and their code through your intended channel. They enter the code on the private-site gate. One successful redemption grants that browser access until code expiry or owner revocation. A new browser consumes another allowed redemption; knowing the owner’s hosting login does not synchronize the visitor credential.
A code with no redemptions left cannot grant another browser access. A browser already granted access can return during its valid period. Test from a separate session before inviting real recipients.
Revoke and verify
Choose Revoke next to a code. The server revokes the associated invitation and removes existing visitor grants. Check the page and its resources again as the visitor; access is checked before serving stored or cached content. Expired code records may be removed after 30 days unless the project is on legal hold. Codes also stop granting access after expiry or when the owner’s Pro access is no longer available.
Changing the project to Public deliberately makes the site public. Keep it invite-only when access should be restricted. Codes can coexist with normal invitation links in invite-only mode.
What codes protect
Codes restrict the entire hosted project. They do not identify a person, charge a payment or secretly protect a report already delivered in browser JavaScript. Authorized readers can inspect delivered HTML, scripts and datasets. The file download policy remains a separate setting and is not bypassed by redeeming a code.
For declared response collection, configure forms independently. For broader choices, see sharing and access. Try the interactive assessment guide for an original browser-scored example.
Last updated on